Drama RAT: Advanced Android Banking Trojan with RAT Capabilities Analyzed by Positive Technologies
Positive Technologies researchers have published a detailed analysis of Drama RAT, a multifunctional Android banking trojan equipped with remote access capabilities. The family spreads through phishing messages in messengers and masquerades as VPN services, banking applications, or cracked utilities with paid features.
All analyzed samples function as droppers. After launch, the user sees a notification about an outdated version and is prompted to install an update. Upon granting installation rights from unknown sources, the dropper sends device information and a list of installed applications to the C2 server, then downloads the main payload.
The dropper contains a library that implements C2 communication and device identification. It transmits a device fingerprint consisting of the SHA-256 hash of the concatenation of ANDROID_ID and the application signature. The server responds with the encrypted payload and part of the decryption key. The final key is assembled from the server-supplied component, a hardcoded value, and the SHA-256 hash of the dropper signature.
After decryption and installation of the payload, the trojan immediately begins exfiltrating device data including identifier, Android version, battery level, network type, wallpaper, SIM information, and granted permissions. It periodically sends heartbeat requests containing accelerometer data to confirm connectivity.
Drama RAT requests Accessibility service permission and then uses libnative_core.so to automatically grant itself additional rights to SMS, contacts, microphone, and screen recording. It overlays a black opaque block to hide the permission-granting process from the user and can draw nearly transparent images to bypass Android 12 camera and microphone indicators.
The trojan implements an extensive set of malicious functions: SMS interception and default SMS handler replacement, clipboard manipulation, browser data theft, real-time keylogging, overlay phishing, application enumeration, call spoofing, VNC screen sharing, covert microphone and camera recording, credential theft, icon hiding, notification suppression, and participation in DDoS attacks directed by the C2 server.
Communication occurs over WebSocket with mutual TLS authentication using a client certificate embedded in libnative_core.so. A fallback channel uses HTTPS requests through CDN domains. Persistence is achieved via AlarmManager alarms firing every eight seconds, Doze mode bypass, and automatic restart after device reboot.
When the user attempts to access settings to uninstall the application or revoke permissions, the malware redirects them to the home screen or main settings menu. Removal is only possible via ADB or by booting into safe mode.
The payload is protected by more than 1200 junk artifacts, deliberately corrupted AndroidManifest.xml structures, root and hooking detection, ptrace anti-debugging, and runtime string decryption that uses Base64 decoding followed by arithmetic operations with per-class keys.
Related articles
Group-IB Discovers RemControl Android Banking Trojan Using Dynamic Overlay Attacks to Steal Banking PINs
Group-IB has identified a new Android banking trojan named RemControl with samples dating back to July 2026. The malware targets more than 30 financial institutions across Europe, the Middle East, and Canada, with Italy and France as primary focus areas. RemControl employs an overlay technique that displays a full-screen phishing replica of the legitimate banking app when the victim launches the real application, capturing PINs, access codes, and card details before seamlessly returning control to the authentic app. Phishing screens are not bundled in the APK but are fetched dynamically from operator-controlled servers reachable via Telegram channels, allowing rapid target changes without reinfection. Distribution relies on fake Google Play listing pages that mimic a streaming application, with geo-targeted delivery for Italian visitors. The trojan requests VPN permissions to block Play Store traffic and bypass real-time security checks, followed by accessibility service access that enables screen reading, keystroke logging, remote taps, and unlock pattern reconstruction.
Solar and F6 Integrate Solar webProxy with F6 Malware Detonation Platform to Filter Web Threats
GC Solar and F6 have confirmed compatibility between the Solar webProxy web access management system and the F6 Malware Detonation Platform. The integration allows Solar webProxy to pre-filter web objects and forward only suspicious files via the ICAP protocol to F6 MDP for reputation checks, static analysis, and dynamic detonation in an isolated virtual environment. Administrators can tune the level of filtering to avoid sending benign items such as fonts and icons to the sandbox, preserving resources for genuine threats. Data from the Solar webProxy team shows that archives accounted for an average of 37 percent of web threats in 2025, with malware frequently hidden inside ZIP, RAR, and 7Z containers. The solution targets medium and large organizations in finance, industry, and the public sector that handle high volumes of web traffic daily.
Engineer Tackles Jane Street ASIC Reverse Engineering Puzzle with Custom Simulator and Verilog Extraction
A detailed technical account describes how one engineer spent weeks reverse engineering an ASIC from GDS files provided in a Jane Street puzzle. The process began with parsing the GDS layout using the gdstk Python library to identify 27 cells in the warmup challenge and thousands of elements in the main task. The engineer built a custom logic simulator backed by SQLite, developed a domain-specific hardware description language, and eventually extracted a netlist that could be converted into Verilog for simulation. Key components identified included shift registers, an adder, and a comparator named comparitor496 in the warmup round. In the full challenge, nearly 10,000 instances of 81 different sky130 standard cells were processed, revealing an unexpected floating net that prompted a bug report to Jane Street. The effort combined manual schematic tracing, graph-based connectivity analysis, and waveform inspection with Surfer to confirm functional behavior.
EtherHiding Campaign Hides Banking Trojan C2 in Polygon Smart Contracts
Security researchers have detailed the EtherHiding campaign, which conceals command-and-control infrastructure inside smart contracts on the Polygon blockchain. The final payload is a malicious browser extension that functions as a banking trojan, intercepting credentials and two-factor codes from approximately 479 financial and cryptocurrency websites. Instead of embedding fixed addresses in its code, the malware queries an encrypted C2 server address from the smart contract, allowing operators to change destinations through low-cost blockchain transactions that bypass domain blocking. Infection begins when victims visit one of 31 compromised legitimate sites that inject JavaScript displaying a fake CAPTCHA prompt. The prompt instructs users to press Windows+R and execute a PowerShell command, a social engineering technique known as ClickFix that downloads the malicious scripts without exploiting any software vulnerability. The campaign has remained active from November 2025 through at least September 2026, demonstrating the resilience of blockchain-based infrastructure against traditional takedown methods.