Threat Intelligence Directory

Malware family identifying apk.luna_spy. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.luckycat. Origin and technical characteristics tracked via Malpedia.

Android banker Trojan with the standard banking capabilities such as overlays, SMS stealing. It also features ransomware functionality. Note, the network traffic is obfuscated the same way as in Android Bankbot.

Malware family identifying apk.loki. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.little_looter. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.landfall. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.ksremote. Origin and technical characteristics tracked via Malpedia.

According to Lookout, this spyware was first observed in March 2022 and remains active with new samples still publicly hosted. It uses a two-stage C2 infrastructure that retrieves initial configurations from a Firebase cloud database. KoSpy can collect extensive data, such as SMS messages, call logs, location, files, audio, and screenshots via dynamically loaded plugins. The spyware has Korean language support with samples distributed across Google Play and third-party app stores such as Apkpure.

Malware family identifying apk.konni. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.koler. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.knspy. Origin and technical characteristics tracked via Malpedia.

KIMWOLF is an android based malware which uses compromised systems to relay malicious and abusive Internet traffic, as well as participating in distributed denial-of-service (DDoS). KIMWOLF primarily infects unofficial Android-TV set-top boxes and digital photo frames. The malware has frequently been noted to achieve infection spread via abusing Android Debug Bridge (ADB) and residential proxies. There are multiple reports suggesting a connection to the Aisuru botnet, with Kimwolf acting as the Android variant.

Malware family identifying apk.kevdroid. Origin and technical characteristics tracked via Malpedia.

Joker is one of the most well-known malware families on Android devices. It manages to take advantage of Google’s official app store with the help of its trail signatures which includes updating the virus’s code, execution process, and payload-retrieval techniques. This malware is capable of stealing users’ personal information including contact details, device data, WAP services, and SMS messages.

Malware family identifying apk.jaderat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.irrat. Origin and technical characteristics tracked via Malpedia.

According to redpiranha, IRATA (Iranian Remote Access Trojan) Android Malware is a new malware detected in the wild. It originates from a phishing attack through SMS. The theme of the message resembles information coming from the government that will ask you to download this malicious application. IRATA can collect sensitive information from your mobile phone including bank details. Since it infects your mobile, it can also gather your SMS messages which then can be used to obtain 2FA tokens.

Android variant of IPStorm (InterPlanetary Storm).

Avira states that Hydra is an Android BankBot variant, a type of malware designed to steal banking credentials. The way it does this is by requesting the user enables dangerous permissions such as accessibility and every time the banking app is opened, the malware is hijacking the user by overwriting the legit banking application login page with a malicious one. The goal is the same, to trick the user to enter his login credentials so that it will go straight to the malware authors.

According to ThreatFabric, this is a malware family based on apk.ermac. The name hook is the self-advertised named by its vendor DukeEugene. It provides WebSocket communication and has RAT capabilities.

RAT, which can be used to extract sensitive information, e.g. contact lists, txt messages, location information.

HiddenAd is a malware that shows ads as overlays on the phone.

Malware family identifying apk.hero_rat. Origin and technical characteristics tracked via Malpedia.

Lookout states that Hermit is an advanced spyware designed to target iOS and Android mobile devices. It is designed to collect extensive amounts of sensitive data on its victims such as their location, contacts, private messages, photos, call logs, phone conversations, ambient audio recordings, and more.

Malware family identifying apk.henbox. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.hawkshaw. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.hardrain. Origin and technical characteristics tracked via Malpedia.

Group-IB describes Gustuff as a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular ecommerce websites and marketplaces. Gustuff has previously never been reported. Gustuff is a new generation of malware complete with fully automated features designed to steal both fiat and crypto currency from user accounts en masse. The Trojan uses the Accessibility Service, intended to assist people with disabilities. The analysis of Gustuff sample revealed that the Trojan is equipped with web fakes designed to potentially target users of Android apps of top international banks including Bank of America, Bank of Scotland, J.P.Morgan, Wells Fargo, Capital One, TD Bank, PNC Bank, and crypto services such as Bitcoin Wallet, BitPay, Cryptopay, Coinbase etc. Group-IB specialists discovered that Gustuff could potentially target users of more than 100 banking apps, including 27 in the US, 16 in Poland, 10 in Australia, 9 in Germany, and 8 in India and users of 32 cryptocurrency apps.

Malware family identifying apk.guerrilla. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.grifthorse. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.gravity_rat. Origin and technical characteristics tracked via Malpedia.

Cisco Talos identifies GPlayed as a malware written in .NET using the Xamarin environment for mobile applications. It is considered powerful because of its capability to adapt after its deployment. In order to achieve this adaptability, the operator has the capability to remotely load plugins, inject scripts and even compile new .NET code that can be executed.

Malware family identifying apk.goontact. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.gold_digger. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.goldenrat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.goldeneagle. Origin and technical characteristics tracked via Malpedia.

According to PCrisk, Godfather is the name of an Android malware targeting online banking pages and cryptocurrency exchanges in 16 countries. It opens fake login windows over legitimate applications. Threat actors use Godfather to steal account credentials. Additionally, Godfather can steal SMSs, device information, and other data.

Malware family identifying apk.goat_rat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.gnatspy. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.glancelove. Origin and technical characteristics tracked via Malpedia.