Fake Document Reader App Hits 10K Downloads, Spreads Anatsa Malware

A newly discovered malicious Android application masquerading as a document reader was found on the Google Play Store, infecting users with the notorious Anatsa banking trojan.

The app, which had already surpassed 10,000 downloads before its removal, highlights the ongoing threat of malware slipping through official app marketplaces.

The malicious app was hosted on the official Google Play Store under the guise of a document reader utility. It was listed at:

The app has since been taken down, but not before reaching over 10,000 installations, indicating a significant exposure window.

ThreatLabz researchers identified the application as part of an active campaign distributing Anatsa, also known as TeaBot, a well-documented Android banking trojan designed to steal financial credentials and sensitive user data.

Attackers leveraged the trust associated with Google Play to distribute the malware, making it more likely for users to install the app without suspicion.

Anatsa Malware Delivery Mechanism

Once installed, the application did not immediately deploy malicious functionality. Instead, it acted as a dropper, retrieving the Anatsa payload from a remote server after installation.

Key technical indicators include:

• Installer SHA256: 5c9b09819b196970a867b1d459f9053da38a6a2721f21264324e0a8ffef01e20
• Payload URL: http://23.251.108[.]10:8080/privacy.txt
• Payload SHA256: 88fd72ac0cdab37c74ce14901c5daf214bd54f64e0e68093526a0076df4e042f

The use of a seemingly benign file name like “privacy.txt” helps the malware evade basic detection mechanisms and avoid raising user suspicion.

After successful installation, the Anatsa payload connects to multiple command-and-control C2 servers to receive instructions and exfiltrate data.

Identified C2 endpoints include:

• http://172.86.91[.]94/api/
• http://193.24.123[.]18:85/api/
• http://162.252.173[.]37:85/api/

These servers enable attackers to remotely control infected devices, deploy additional payloads, and conduct credential harvesting operations.

Anatsa Capabilities and Risks

Anatsa is a sophisticated banking trojan that primarily targets financial applications. Its capabilities include:

• Overlay attacks to steal login credentials from banking apps.
• Keylogging and screen capture.
• Intercepting SMS messages, including one-time passwords (OTPs).
• Performing fraudulent transactions.

The malware often uses accessibility service abuse to gain elevated permissions, allowing it to operate stealthily in the background.

This incident reflects a broader trend where threat actors continuously upload seemingly legitimate apps to trusted platforms like Google Play.

These apps often pass initial security checks by delaying malicious behavior or dynamically loading payloads post-installation.

Despite Google’s security measures such as Play Protect, attackers continue to evolve their tactics to bypass detection mechanisms.

Users and organizations should take the following precautions:

• Avoid installing apps with limited reviews or unclear developer information.
• Monitor app permissions, especially requests for accessibility services.
• Use mobile security solutions capable of detecting trojan behavior.
• Regularly update devices and applications.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.