Published 2026-05-16 by the Droidwatch Security Research team
Anatsa (also tracked as TeaBot) is one of the most technically sophisticated
Android banking trojans currently circulating in the wild. It has stolen
credentials from customers of over 600 banking applications across 65 countries,
and its operators continuously update the dropper chain to evade detection.
Despite that sophistication, Droidwatch classifies Anatsa samples as Malicious
in under 3 seconds of static analysis time. This post explains exactly which
signals give it away — and shows the detection rules and findings JSON that make
it happen.
What makes Anatsa distinctive
Anatsa combines four technical capabilities that, individually, might appear in
legitimate apps. The combination is what makes it identifiable:
1. Overlay detection
Anatsa draws a full-screen HTML overlay on top of targeted banking apps using
TYPE_APPLICATION_OVERLAY. The overlay is pixel-perfect — it mirrors the
legitimate bank's login screen and silently captures credentials before
forwarding them to a C2 server.
The static fingerprint: android.permission.SYSTEM_ALERT_WINDOW declared in
the manifest and string references to TYPE_APPLICATION_OVERLAY and a
package filter list (a JSON array of target bank package names) embedded in
the DEX classes.
2. Accessibility service abuse
Anatsa registers an AccessibilityService to monitor foreground application
changes. When a targeted banking app comes to the foreground, the service
triggers the overlay injection without any user interaction.
The accessibilty service also intercepts TYPE_VIEW_TEXT_CHANGED events to
harvest keystrokes, and TYPE_WINDOW_STATE_CHANGED to detect when users
navigate away.
3. C2 communication patterns
Early Anatsa versions used hardcoded IP addresses. Newer variants (v4+) use
DGA-style domain generation or encode the C2 address in the app's assets
(commonly assets/strings.xml or a PNG file with steganography). The DEX
strings always contain HTTP POST construction code referencing paths like
/bot/register, /bot/injectResult, and /bot/task.
4. DEX obfuscation
Anatsa consistently uses string splitting and recombination to evade naive
string-match detection:
// Decompiled from an Anatsa sample (JADX output)
private static String a() {
return "Ljavax/crypto/Ci" + "pher;";
}
Droidwatch's DEX deep analyzer detects these patterns using an obfuscation
heuristic score. Anatsa samples typically score 7–9 out of 10.
The YARA rules that catch it
Droidwatch ships with the following YARA rule for Anatsa family detection:
rule Anatsa_BankingTrojan_v4 {
meta:
description = "Detects Anatsa/TeaBot banking trojan DEX patterns (v3-v4 dropper chain)"
author = "Droidwatch Security Research"
date = "2026-05-01"
severity = "critical"
mitre = "T1417.002, T1422, T1636.002"
family = "Anatsa"
reference = "https://threatfabric.com/blogs/anatsa-new-campaign.html"
strings:
// C2 endpoint fragments (split across methods in obfuscated variants)
$c2_register = "/bot/register" ascii wide
$c2_task = "/bot/task" ascii wide
$c2_inject = "/bot/injectResult" ascii wide
// Overlay trigger string (recombined at runtime but partial is present)
$overlay_type = "TYPE_APPLICATION_OVERLAY" ascii
// Accessibility event types used for keylogging
$a11y_text = "TYPE_VIEW_TEXT_CHANGED" ascii
$a11y_window = "TYPE_WINDOW_STATE_CHANGED" ascii
// Package filter array — Anatsa embeds target bank package names
$pkg_filter = "targetPackages" ascii
// DEX string split/join obfuscation pattern
$obf_1 = "Ljavax/crypto/Ci" ascii
$obf_2 = "Landroid/telephony" ascii
condition:
(2 of ($c2_*))
and $overlay_type
and (1 of ($a11y_*))
and (
$pkg_filter
or (1 of ($obf_*))
)
}
This rule hits on the combination of C2 endpoint fragments, overlay capability,
and accessibility abuse — three signals that together have a near-zero false
positive rate on legitimate apps.
Example findings JSON
Here is an excerpt from the actual findings array in a Droidwatch report for an
Anatsa dropper (score: 91, verdict: "Malicious"):
{
"overview": {
"score": 91,
"verdict": "Malicious",
"severities": {
"critical": 3,
"high": 5,
"medium": 4,
"low": 2,
"info": 8
}
},
"findings": [
{
"id": "YARA_ANATSA_V4",
"title": "Anatsa Banking Trojan — YARA match (v4 dropper chain)",
"severity": "critical",
"confidence": 0.97,
"category": "malware_family",
"description": "YARA rule Anatsa_BankingTrojan_v4 matched 7/8 strings including C2 endpoint fragments (/bot/register, /bot/task), overlay API references, and accessibility event abuse patterns.",
"mitre_techniques": ["T1417.002", "T1422", "T1636.002"],
"evidence": {
"yara_rule": "Anatsa_BankingTrojan_v4",
"matched_strings": [
"/bot/register",
"/bot/task",
"/bot/injectResult",
"TYPE_APPLICATION_OVERLAY",
"TYPE_VIEW_TEXT_CHANGED",
"targetPackages",
"Ljavax/crypto/Ci"
]
}
},
{
"id": "RULE_ACCESSIBILITY_FULL",
"title": "Accessibility Abuse: Service + Permission + API References",
"severity": "critical",
"confidence": 0.92,
"category": "accessibility",
"description": "App registers an AccessibilityService with BIND_ACCESSIBILITY_SERVICE permission and contains string references to sensitive accessibility event types used for keylogging.",
"mitre_techniques": ["T1417"]
},
{
"id": "RULE_OVERLAY_PERM_AND_STRING",
"title": "Overlay Attack: SYSTEM_ALERT_WINDOW + TYPE_APPLICATION_OVERLAY",
"severity": "high",
"confidence": 0.88,
"category": "overlay",
"description": "SYSTEM_ALERT_WINDOW permission combined with TYPE_APPLICATION_OVERLAY string references indicates overlay injection capability targeting banking apps.",
"mitre_techniques": ["T1417.002"]
},
{
"id": "BANKING_TARGET_LIST",
"title": "Embedded Banking App Target List",
"severity": "critical",
"confidence": 0.95,
"category": "banking_signals",
"description": "DEX strings contain a JSON array of banking application package names consistent with Anatsa's target list. 47 package names identified including packages from US, EU, and LATAM financial institutions.",
"evidence": {
"sample_packages": [
"com.chase.sig.android",
"com.bankofamerica.cashpromgr",
"com.wellsfargo.mobile.app"
],
"total_found": 47
}
}
]
}
Why 3 seconds?
The speed comes from the analysis pipeline:
- APK unzip + manifest parse (~200 ms) — permissions, receivers, and services
are extracted immediately. - DEX string extraction (~400 ms) — all string literals across all DEX files
are extracted into a flat index. - YARA scan on string index (~80 ms) — the string index is scanned against
all loaded YARA rules. No full DEX disassembly required for the initial verdict. - Scoring engine (~50 ms) — rule matches are fed into the scoring engine which
computes the final 0–100 score and verdict.
Deep DEX disassembly (call graph, data flow analysis) runs in the background and
enriches the report asynchronously, but the initial verdict is available within
the first pass.
Try it yourself
Upload a suspicious APK at droidwatch.app — no registration
required for the first three analyses. If you are a security team dealing with
banking trojan incidents at scale, the Pro or Enterprise plan
gives you bulk API access, STIX 2.1 export for SIEM ingestion, and a private
threat feed of all samples analyzed by your team.
Questions or sample submissions: [email protected]