Threat Intelligence Directory

Malware family identifying apk.residentbat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.remrat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.remo. Origin and technical characteristics tracked via Malpedia.

RedAlert 2 is an new Android malware used by an attacker to gain access to login credentials of various e-banking apps. The malware works by overlaying a login screen with a fake display that sends the credentials to a C2 server. The malware also has the ability to block incoming calls from banks, to prevent the victim of being notified. As a distribution vector RedAlert 2 uses third-party app stores and imitates real Android apps like Viber, Whatsapp or fake Adobe Flash Player updates.

Malware family identifying apk.raxir. Origin and technical characteristics tracked via Malpedia.

According to ThreatFabric, this RAT can perform NFC relay attacks and has Automated Transfer ystem (ATS) capabilities

RatMilad, a newly discovered Android spyware, has been stealing data from mobile devices in the Middle East. The malware is spread through links on social media and pretends to be applications for services like VPN and phone number spoofing. Unwary users download these trojan applications and grant access to malware.

Malware family identifying apk.rana. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.rambleon. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.rafelrat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.princess. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.premier_rat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.pornhub. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.popr-d30. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.podec. Origin and technical characteristics tracked via Malpedia.

According to Lookout, PlainGnome consists of a two-stage deployment in which a very minimal first stage drops a malicious APK once it’s installed. The code of PlainGnome’s second stage payload evolved significantly from January 2024 through at least October. In particular, PlainGnome’s developers shifted to using Jetpack WorkManager classes to handle data exfiltration, which eases development and maintenance of related code. In addition, WorkManager allows for specifying execution conditions. For example, PlainGnome only exfiltrates data from victim devices when the device enters an idle state. This mechanism is probably intended to reduce the chance of a victim noticing the presence of PlainGnome on their device. As opposed to the minimalist first (installer) stage, the second stage carries out all surveillance functionality and relies on 38 permissions.

Malware family identifying apk.pjobrat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.pixstealer. Origin and technical characteristics tracked via Malpedia.

According to PCrisk, The PixPirate is a dangerous Android banking Trojan that has the capability to carry out ATS (Automatic Transfer System) attacks. This allows threat actors to automatically transfer funds through the Pix Instant Payment platform, which numerous Brazilian banks use. In addition to launching ATS attacks, PixPirate can intercept and delete SMS messages, prevent the uninstallation process, and carry out malvertising attacks.

According to Mandiant, PINEFLOWER is an Android malware family capable of a wide range of backdoor functionality, including stealing system inform information, logging and recording phone calls, initiating audio recordings, reading SMS inboxes and sending SMS messages. The malware also has features to facilitate device location tracking, deleting, downloading, and uploading files, reading connectivity state, speed, and activity, and toggling Bluetooth, Wi-Fi, and mobile data settings.

According to Zimperium, PhoneSpy is a spyware aimed at South Korean residents with Android devices.

Malware family identifying apk.phoenix. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.phantomlance. Origin and technical characteristics tracked via Malpedia.

According to TechCrunch, this is a remote surveillance app that allows ordinary consumers to buy software capable of tracking people and their data without their knowledge. Once physically planted on a person’s phone or computer (usually with knowledge of the victim’s passcode or login), the app would continuously upload a copy of the victim’s information, including messages, photos, and location data, to pcTattletale’s servers and make the data accessible to whoever planted the spyware.

Malware family identifying apk.packchat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.oscorp. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.omnirat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.nexus. Origin and technical characteristics tracked via Malpedia.

MysteryBot is an Android banking Trojan with overlay capabilities with support for Android 7/8 but also provides other features such as key logging and ransomware functionality.

Malware family identifying apk.mudwater. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.morder_rat. Origin and technical characteristics tracked via Malpedia.

MoqHao, also called Wroba and XLoader (not to be confused with the malware of the same name for Windows and macOS), is an Android-based mobile threat that is associated with a financially motivated Chinese group called Roaming Mantis. The malware claims to be the default SMS application and has dropper and banker capabilities.

Monokle is a sophisticated mobile surveillanceware that possesses remote access trojan (RAT) functionality, advanced data exfiltration techniques as well as the ability to install an attacker-specified certificate to the trusted certificates on an infected device that would allow for man-in-the-middle (MITM) attacks. According to Lookout researchers, It is believed to be developed by Special Technology Center (STC), which is a Russian defense contractor sanctioned by the U.S. Government in connection to alleged interference in the 2016 US presidential elections.

Check Point has identified samples of this spyware being distributed since 2015. No samples were found on Google Play, meaning they were likely through other channels like social engineering.

Malware family identifying apk.meterpreter. Origin and technical characteristics tracked via Malpedia.

According to ThreatFabric, this is an Android banking trojan under active development as of July 2020. It is using TCP for C&C communication and targets Turkish banks.

Malware family identifying apk.mazarbot. Origin and technical characteristics tracked via Malpedia.

According to heimdal, MasterFred malware, this is designed as an Android trojan that makes use of false login overlays to target not only Netflix, Instagram, and Twitter users, but also bank customers. The hackers’ goal is to steal credit card information.

Malware family identifying apk.marcher. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.mandrake. Origin and technical characteristics tracked via Malpedia.