{
  "name": "Android Banker with Complete Device Takeover Capabilities",
  "slug": "android-banker-with-complete-device-takeover-capabilities",
  "description": "A newly identified Android banking trojan named Rokarolla has been discovered, distributed through malicious websites masquerading as popular applications like TikTok or Google Chrome. The malware targets 217 distinct cryptocurrency and banking applications using 137 sophisticated commands for device control. Capabilities include harvesting lock screen credentials, exfiltrating contact lists and SMS data, deploying keyloggers, blocking calls, creating fraudulent screen overlays, and disabling Google Play Protect. The infection begins with a dropper impersonating Google Play Protect that installs a secondary payload. Rokarolla communicates with C2 infrastructure via HTTPS, uses overlays to steal banking credentials and device unlock patterns, silently monitors WhatsApp contacts, hijacks SMS and calls, manipulates clipboard content for cryptocurrency theft, and employs snapshot-based screen surveillance. It maintains persistence by hiding its icon, muting device audio, and keeping screens active indefinitely.",
  "published": "2026-06-16T14:27:52.275000+00:00",
  "created_at": "2026-06-16T17:19:01.042000+00:00",
  "modified_at": "2026-06-16T15:19:01+00:00",
  "created_at_opencti": "2026-06-16T17:19:01.042000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "accessibility abuse",
    "android trojan",
    "banking credentials",
    "cryptocurrency theft",
    "keylogger",
    "overlay attacks",
    "rokarolla",
    "sms hijacking"
  ],
  "tags": [
    "2026-06-16",
    "accessibility abuse",
    "android trojan",
    "banking credentials",
    "cryptocurrency theft",
    "keylogger",
    "overlay attacks",
    "rokarolla",
    "sms hijacking"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://morevoms.cfd"
      },
      {
        "id": "",
        "name": "https://beralisvc.info"
      },
      {
        "id": "",
        "name": "https://abiorime.cfd"
      },
      {
        "id": "",
        "name": "https://blestorians.cfd"
      },
      {
        "id": "",
        "name": "e76cbdf420540a18e2ddea02938acf3c4b4139f3511d314dca9781afe1e439bb"
      },
      {
        "id": "",
        "name": "3e25c28c5e93376683e841b7ad60f9383bb3bf831284a93a4aae798fc769d767"
      },
      {
        "id": "",
        "name": "f49be77b95cabd28d2dfe91786863576f6bd3f43a9d6de67a5b5851afe3aff9a"
      },
      {
        "id": "",
        "name": "4e2cbefc6bdbfdb6e885057ce47d460e3d3355a5e97db51b22e9c5a14e14302b"
      },
      {
        "id": "",
        "name": "d6403ec82659eb62424bb1033615a8df27635080d02e438a4ee7e2334b1155f7"
      },
      {
        "id": "",
        "name": "c3e324106803df27f5b6e0d49d2daf02d4cde396af4401f1ad29d78198e370b6"
      },
      {
        "id": "",
        "name": "7aa389f25997610a96f014977eecd6d69142bdc63841e0d84976e3e621831303"
      },
      {
        "id": "",
        "name": "1ba364113c4cec5542d1b2c76d7c163a66bdf90bc373256d5178f880f9742960"
      },
      {
        "id": "",
        "name": "8ddbcebe1014a645855986e85b2c54ee167baf1e9a0d74179faf81a5ee6878f4"
      },
      {
        "id": "",
        "name": "57307ee8a3cda10730eacecaf789fab6f8771f9d29397e07c31a6bd4551bba10"
      },
      {
        "id": "",
        "name": "ed036356fa2d3490d3ddb5ee7ae98bab80b505938f0199d9b10f12266f345896"
      },
      {
        "id": "",
        "name": "890ecea4ebe4fea692ad36adf02abeb37c181cb7bdb6122cd52d9aaafe7d6cf3"
      },
      {
        "id": "",
        "name": "a5e6763b09553691c8b42deefb725fa3b8c133a03a34cea87740b1f13d08bac3"
      },
      {
        "id": "",
        "name": "2eb80e5519fc6defcec8cc30a5cf4f75ee5ec8d2435759bb77c19826f1e20efb"
      },
      {
        "id": "",
        "name": "1d3270a9141f8f16047799f1132633d72fd421b6c8f1878b5ef04ced6add4db8"
      },
      {
        "id": "",
        "name": "8d65e4df0ad369f491698437413afd1bd55fff309860f9cdecc778c9ac062282"
      },
      {
        "id": "",
        "name": "62aef76c2d1897203649844b45317d9e1723819479a2b88ca4b3290ca9f4c9f0"
      },
      {
        "id": "",
        "name": "c3cfe522d2da15b033f65eb5377bf9e99be598dc4c21729e6f168dbc8f19540b"
      },
      {
        "id": "",
        "name": "e134cffcbe1fa8a861fd1f9a506f10ca5ff56cd5082360ef13d204676792e8bc"
      },
      {
        "id": "",
        "name": "fe41e6c1725f63582f022a17abe098e49338a78118a00ca87785b2fa0cf3dadf"
      },
      {
        "id": "",
        "name": "5139253b1f30b34ab3aa888aba175866fa1f82728ab07b999c24b49b191c3f68"
      },
      {
        "id": "",
        "name": "aec2a36e8d68b23444348a7cec2d6ec287cb8810d1e190e04743645426ababb1"
      },
      {
        "id": "",
        "name": "f8cb375a4129358ad5881c29a6921fc1e5773028c0b31da83298f606118b185a"
      },
      {
        "id": "",
        "name": "726095e56c693977b7796dc7cead2e2a49551d77d3f442aaa28997615ba07e99"
      },
      {
        "id": "",
        "name": "48a3db92fac1ba9c218253576e09f42faabeaf48cf80663cf32e06b0a66e983d"
      },
      {
        "id": "",
        "name": "5d0c5d8da8202f512339457ae00ed2d9b9c930cefc63fa5a28a049aba4127ab7"
      },
      {
        "id": "",
        "name": "3fae7ede2ef9c809b54504c3d78e5111d7fad0b522c707b8f6ff21015af79251"
      },
      {
        "id": "",
        "name": "1e4ed7e40608750cd0bfe96f5ed493a022b58ec54da2345336c522f7c78197af"
      },
      {
        "id": "",
        "name": "c734a665f04eb9ab17047e65940fc35bad0221d59c2fc4fd0d170f2181514034"
      },
      {
        "id": "",
        "name": "1f4c70cb317ffd25adc828fbac3bb8f07739e23111f7b7905926489fe35f8973"
      },
      {
        "id": "",
        "name": "97e76acebea510c8641183866be4392601314b20e73c7ba8cf1f3ee2de6080fd"
      },
      {
        "id": "",
        "name": "696ef29f77a91aa91279c83088a07ab137d5049dc096ef862a35f9d890a552b3"
      },
      {
        "id": "",
        "name": "f0c18f045e3bb0193ef1169f5fa1abff7aa47e9a23da35cf67bbb9548a5e32c0"
      },
      {
        "id": "",
        "name": "9a8ec3b21fdb4167f8fdd46f4d38b9a99ff2d3515ee70215438a1360c1474221"
      },
      {
        "id": "",
        "name": "be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34"
      },
      {
        "id": "",
        "name": "c505353a6c58a21cb7b0343202e8629bee2f121f01c21dd8e0b61b7c55b77495"
      },
      {
        "id": "",
        "name": "d7d960ef10b08c472ad397b6fd9e9481338b2077c7c2f44d3dc2c65b19345ae0"
      },
      {
        "id": "",
        "name": "c08cd3f78c0edcced6b1a694284b6ed4a9e0422f469e07c702c4a8d1f6c186f4"
      },
      {
        "id": "",
        "name": "3c304a1ac73590aaf94b62711a5f2fd0cbb863dab13aef6ec1eb156f4a7bd5b9"
      },
      {
        "id": "",
        "name": "43888be8debbbd74012484d4e4f9a1c70c2ff3970e0bf499c9aebba9776930a1"
      },
      {
        "id": "f0e18c83-2f35-46d5-9e93-70694ed8ea83",
        "name": "beralisvc.info"
      },
      {
        "id": "f59deaeb-b360-40be-a2c0-b1d1d742c65e",
        "name": "abiorime.cfd"
      },
      {
        "id": "a2897860-b7cb-4269-8822-bb662c4383a7",
        "name": "morevoms.cfd"
      },
      {
        "id": "a73dbeab-0310-436c-927d-b20d10810ca0",
        "name": "blestorians.cfd"
      }
    ],
    "malware": [
      {
        "id": "legacy:malware:08762af0b8dc446b",
        "name": "Rokarolla",
        "slug": "rokarolla"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "abiorime.cfd"
      },
      {
        "id": "",
        "name": "beralisvc.info"
      },
      {
        "id": "",
        "name": "morevoms.cfd"
      },
      {
        "id": "",
        "name": "blestorians.cfd"
      }
    ],
    "indicators": [
      {
        "id": "76dd2a89-bd45-4768-9076-cd44c7cd5ad7",
        "name": "e76cbdf420540a18e2ddea02938acf3c4b4139f3511d314dca9781afe1e439bb"
      },
      {
        "id": "0c73b68b-bae8-471f-b269-052cf44626e7",
        "name": "3e25c28c5e93376683e841b7ad60f9383bb3bf831284a93a4aae798fc769d767"
      },
      {
        "id": "40949bb1-25f4-49f3-a546-912357630443",
        "name": "f49be77b95cabd28d2dfe91786863576f6bd3f43a9d6de67a5b5851afe3aff9a"
      },
      {
        "id": "7b9cacb2-88d4-4ac0-8057-d40ae423f071",
        "name": "4e2cbefc6bdbfdb6e885057ce47d460e3d3355a5e97db51b22e9c5a14e14302b"
      },
      {
        "id": "92b620b3-ced4-46c5-b484-0e28a4e39f19",
        "name": "d6403ec82659eb62424bb1033615a8df27635080d02e438a4ee7e2334b1155f7"
      },
      {
        "id": "a089e979-4e89-4d7a-a846-6f3698e76bd7",
        "name": "c3e324106803df27f5b6e0d49d2daf02d4cde396af4401f1ad29d78198e370b6"
      },
      {
        "id": "d10d9eb9-e026-480a-bdb5-499018f9acf3",
        "name": "7aa389f25997610a96f014977eecd6d69142bdc63841e0d84976e3e621831303"
      },
      {
        "id": "75285711-f1d4-40c9-ab96-11521c251eb0",
        "name": "1ba364113c4cec5542d1b2c76d7c163a66bdf90bc373256d5178f880f9742960"
      },
      {
        "id": "5c55cbb6-1160-4779-9267-b501a0db8e0f",
        "name": "8ddbcebe1014a645855986e85b2c54ee167baf1e9a0d74179faf81a5ee6878f4"
      },
      {
        "id": "bad5f5d9-fe5e-4f09-9849-859d543f2855",
        "name": "57307ee8a3cda10730eacecaf789fab6f8771f9d29397e07c31a6bd4551bba10"
      },
      {
        "id": "ad3589e4-9c23-41ae-90fa-6668d2e04ea3",
        "name": "ed036356fa2d3490d3ddb5ee7ae98bab80b505938f0199d9b10f12266f345896"
      },
      {
        "id": "a90b0e00-b958-41a2-a7a7-3680c611bad2",
        "name": "abiorime.cfd"
      },
      {
        "id": "ee6307cb-61b8-494f-a0c4-a369b829b62b",
        "name": "890ecea4ebe4fea692ad36adf02abeb37c181cb7bdb6122cd52d9aaafe7d6cf3"
      },
      {
        "id": "797753ab-3d26-4a88-9961-fb51ac62b2e9",
        "name": "a5e6763b09553691c8b42deefb725fa3b8c133a03a34cea87740b1f13d08bac3"
      },
      {
        "id": "0e3863df-a55f-4fd7-96a2-1b904bb85b15",
        "name": "2eb80e5519fc6defcec8cc30a5cf4f75ee5ec8d2435759bb77c19826f1e20efb"
      },
      {
        "id": "953126e3-89a3-4d60-9e29-a6c76d1e2740",
        "name": "1d3270a9141f8f16047799f1132633d72fd421b6c8f1878b5ef04ced6add4db8"
      },
      {
        "id": "7383672e-4cd7-4e3d-a071-13deb3723792",
        "name": "8d65e4df0ad369f491698437413afd1bd55fff309860f9cdecc778c9ac062282"
      },
      {
        "id": "d8a86e85-553f-4450-b1e6-ba50283477a3",
        "name": "62aef76c2d1897203649844b45317d9e1723819479a2b88ca4b3290ca9f4c9f0"
      },
      {
        "id": "7679507d-5284-44f2-944a-7b8572b3f1b3",
        "name": "c3cfe522d2da15b033f65eb5377bf9e99be598dc4c21729e6f168dbc8f19540b"
      },
      {
        "id": "457a35e1-f994-404f-ae5a-39674869b21b",
        "name": "e134cffcbe1fa8a861fd1f9a506f10ca5ff56cd5082360ef13d204676792e8bc"
      },
      {
        "id": "516c5bdd-eaec-4bf8-a8f9-cb7878fae4cc",
        "name": "https://morevoms.cfd"
      },
      {
        "id": "9ea1afb0-51d0-4313-9e68-587495f28045",
        "name": "fe41e6c1725f63582f022a17abe098e49338a78118a00ca87785b2fa0cf3dadf"
      },
      {
        "id": "bf320022-2edc-4f1f-a154-a1bc340f201d",
        "name": "5139253b1f30b34ab3aa888aba175866fa1f82728ab07b999c24b49b191c3f68"
      },
      {
        "id": "d07cd042-4a22-4536-9a9b-90d8ced9fcf0",
        "name": "aec2a36e8d68b23444348a7cec2d6ec287cb8810d1e190e04743645426ababb1"
      },
      {
        "id": "dc8b0d36-1eb1-4efb-8433-d9852cc676b3",
        "name": "f8cb375a4129358ad5881c29a6921fc1e5773028c0b31da83298f606118b185a"
      },
      {
        "id": "8a9e5a3a-4e16-4006-9647-6188c57527fd",
        "name": "beralisvc.info"
      },
      {
        "id": "5234ba58-a5e1-47b7-b868-5a9221f92122",
        "name": "726095e56c693977b7796dc7cead2e2a49551d77d3f442aaa28997615ba07e99"
      },
      {
        "id": "d8adbfb0-aa25-47b6-b40d-8f7d6db79973",
        "name": "48a3db92fac1ba9c218253576e09f42faabeaf48cf80663cf32e06b0a66e983d"
      },
      {
        "id": "6749d329-e048-4189-9b15-97c5eeadc97a",
        "name": "5d0c5d8da8202f512339457ae00ed2d9b9c930cefc63fa5a28a049aba4127ab7"
      },
      {
        "id": "9980ceb6-d165-4ccc-ad62-ff8353a89705",
        "name": "3fae7ede2ef9c809b54504c3d78e5111d7fad0b522c707b8f6ff21015af79251"
      },
      {
        "id": "4afe0a24-56cc-4069-bc02-ec8376532784",
        "name": "1e4ed7e40608750cd0bfe96f5ed493a022b58ec54da2345336c522f7c78197af"
      },
      {
        "id": "5a85ab2e-a409-4931-bb51-c3ab3acebb6c",
        "name": "c734a665f04eb9ab17047e65940fc35bad0221d59c2fc4fd0d170f2181514034"
      },
      {
        "id": "aab088fa-96d7-4488-8f95-12e9a42c8d13",
        "name": "1f4c70cb317ffd25adc828fbac3bb8f07739e23111f7b7905926489fe35f8973"
      },
      {
        "id": "4ebecb05-a0a8-4601-9836-f81f3575dd86",
        "name": "97e76acebea510c8641183866be4392601314b20e73c7ba8cf1f3ee2de6080fd"
      },
      {
        "id": "b55cc5e4-2f65-4828-aa78-304d93b0aaaf",
        "name": "696ef29f77a91aa91279c83088a07ab137d5049dc096ef862a35f9d890a552b3"
      },
      {
        "id": "dfe679db-28e2-4573-98ba-bef29de97bfb",
        "name": "f0c18f045e3bb0193ef1169f5fa1abff7aa47e9a23da35cf67bbb9548a5e32c0"
      },
      {
        "id": "6c7a967e-dcd1-4060-81a1-5336fff86bf8",
        "name": "9a8ec3b21fdb4167f8fdd46f4d38b9a99ff2d3515ee70215438a1360c1474221"
      },
      {
        "id": "f68a798a-1ba6-4cfd-a3ab-22c4d2a8c4a0",
        "name": "be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34"
      },
      {
        "id": "e11af42e-f091-4849-a705-84849edc73b9",
        "name": "morevoms.cfd"
      },
      {
        "id": "be40db5e-13d4-42e0-840b-abb0c5878263",
        "name": "https://beralisvc.info"
      },
      {
        "id": "3444421a-d451-4b4b-9f15-d973bca3cfd8",
        "name": "c505353a6c58a21cb7b0343202e8629bee2f121f01c21dd8e0b61b7c55b77495"
      },
      {
        "id": "7fbb2a16-40b8-4e34-b62f-dd2c352b29fa",
        "name": "blestorians.cfd"
      },
      {
        "id": "d1baa15e-050f-4325-8b42-8aef970c91dc",
        "name": "https://abiorime.cfd"
      },
      {
        "id": "436832b5-3bd0-465f-80ad-64531f74eec2",
        "name": "https://blestorians.cfd"
      },
      {
        "id": "51d05c8a-4266-4fde-a4dc-889730256de1",
        "name": "d7d960ef10b08c472ad397b6fd9e9481338b2077c7c2f44d3dc2c65b19345ae0"
      },
      {
        "id": "3bb8f615-3fd4-4914-b695-6289ebca3dc4",
        "name": "c08cd3f78c0edcced6b1a694284b6ed4a9e0422f469e07c702c4a8d1f6c186f4"
      },
      {
        "id": "cf8cc406-fd50-4061-accc-421a769b4f73",
        "name": "3c304a1ac73590aaf94b62711a5f2fd0cbb863dab13aef6ec1eb156f4a7bd5b9"
      },
      {
        "id": "89c0ab5b-ce71-42ae-8126-cc34c1599f74",
        "name": "43888be8debbbd74012484d4e4f9a1c70c2ff3970e0bf499c9aebba9776930a1"
      }
    ]
  },
  "external_refs": [
    "https://zimperium.com/blog/rokarolla-android-banker-with-complete-device-takeover-capabilities",
    "https://otx.alienvault.com/pulse/6a315d684f0c09972ddea652"
  ]
}