Malware

Hqwar

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Each bank on the list has the equivalent of a phishing page that can be presented if the owner of the android phone attempts to log in to the given bank.

Execution

1 technique

T1204.002Malicious FileEvidence1

The most common point of distribution seems to be from the Google Play Store.

Stealth

1 technique

T1027.002Software PackingEvidence1

droppers, such as Badpack and Hqwar, designed for stealthily delivering Trojan bankers or spyware to smartphones, are very popular among malicious actors who attack mobile devices.

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

At the time of the server dump, this one contained 32,900+ unique “keylog” entries... Keylogging was also enabled, allowing the criminal to see when a bank app was being used

T1649Steal or Forge Authentication CertificatesEvidence1

One of the main benefits of having access to the server was to see so many examples of successful SMS message intercepts!... Here’s an example showing a Bank Two Factor Authentication request being forward to the criminals

Collection

2 techniques

T1056.001KeyloggingEvidence1

At the time of the server dump, this one contained 32,900+ unique “keylog” entries... Keylogging was also enabled, allowing the criminal to see when a bank app was being used

T1213Data from Information RepositoriesEvidence1

In a directory called “/numers/” there were also examples of address book dumps from phone contacts.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

Subsequent actions of such apps may be anything from downloading or dropping other apps to displaying ads.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

securelistNews

May 7, 2024

Analysis of the SoumniBot Android banker | Securelist

Android dropper mentioned as an example of malware used to stealthily deliver banker trojans or spyware to smartphones.

securelistNews

May 13, 2021

Android threat report for Q3 2025 | Securelist

An Android dropper family observed primarily in Turkey in this reporting period.

securelistNews

May 13, 2021

Mobile threat statistics for Q3 2024 | Securelist

An Android Trojan/dropper family active primarily in Turkey.

securelistNews

May 13, 2021

Mobile malware evolution 2019 | Securelist

Android malware family primarily discussed as a dropper whose activity declined sharply in 2019; also appears in banking Trojan family rankings.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Hqwar

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Each bank on the list has the equivalent of a phishing page that can be presented if the owner of the android phone attempts to log in to the given bank.

Execution

1 technique

T1204.002Malicious FileEvidence1

The most common point of distribution seems to be from the Google Play Store.

Stealth

1 technique

T1027.002Software PackingEvidence1

droppers, such as Badpack and Hqwar, designed for stealthily delivering Trojan bankers or spyware to smartphones, are very popular among malicious actors who attack mobile devices.

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

At the time of the server dump, this one contained 32,900+ unique “keylog” entries... Keylogging was also enabled, allowing the criminal to see when a bank app was being used

T1649Steal or Forge Authentication CertificatesEvidence1

Collection

2 techniques

T1056.001KeyloggingEvidence1

At the time of the server dump, this one contained 32,900+ unique “keylog” entries... Keylogging was also enabled, allowing the criminal to see when a bank app was being used

T1213Data from Information RepositoriesEvidence1

In a directory called “/numers/” there were also examples of address book dumps from phone contacts.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

Subsequent actions of such apps may be anything from downloading or dropping other apps to displaying ads.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

securelistNews

May 7, 2024

Analysis of the SoumniBot Android banker | Securelist

Android dropper mentioned as an example of malware used to stealthily deliver banker trojans or spyware to smartphones.

securelistNews

May 13, 2021

Android threat report for Q3 2025 | Securelist

An Android dropper family observed primarily in Turkey in this reporting period.

securelistNews

May 13, 2021

Mobile threat statistics for Q3 2024 | Securelist

An Android Trojan/dropper family active primarily in Turkey.

securelistNews

May 13, 2021

Mobile malware evolution 2019 | Securelist

Android malware family primarily discussed as a dropper whose activity declined sharply in 2019; also appears in banking Trojan family rankings.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.