Malware

MysteryBot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1546.008Accessibility FeaturesEvidence1

When the malware is first launched on the device, it will start by hiding its icon from the app drawer... As second step it asks the victim for the Accessibility Service privileges.

Privilege Escalation

1 technique

T1546.008Accessibility FeaturesEvidence1

When the malware is first launched on the device, it will start by hiding its icon from the app drawer... As second step it asks the victim for the Accessibility Service privileges.

Stealth

1 technique

T1070.004File DeletionEvidence1

after which the original files are deleted... zipFile . addFiles ( paths , zipParameters ) ; file . delete ( )

Credential Access

3 techniques

T1056Input CaptureEvidence1

the key logging mechanism is based on touch points on the screen instead of using the commonly abused Android Accessibility Service, meaning that it has potential to log more than the usually keystrokes.

T1056.001KeyloggingEvidence1

MysteryBot actor(s) did innovate keylogging with this new implementation. Effectively lowering detection rates and limiting the user interaction required to enable the logger. Indeed, the key logging mechanism is based on touch points on the screen instead of using the commonly abused Android Accessibility Service

T1056.002GUI Input CaptureEvidence1

The get_inj_list action retrieves the targeted apps with overlays from the C&C server... The implementation of the overlay attack abuses the Usage Access permission in order to run on all version of the Android operating system including the latest Android 7 and 8.

Discovery

2 techniques

T1010Application Window DiscoveryEvidence1

public void getLastUsedApplication ( ) { ... List usageStatsList = ( ( UsageStatsManager ) usageStatsManager ) . queryUsageStats ... String packageName = ... getPackageName ( ) ;

T1083File and Directory DiscoveryEvidence1

This code snippet shows the code that recursively scans directories: scanDirectory() ... if ( currentFile . isDirectory ( ) ) { this . scanDirectory ( currentFile ) ; } else { this . deleteFileEncryptInZip ( currentFile ) ; }

Collection

4 techniques

T1056Input CaptureEvidence1

T1056.001KeyloggingEvidence1

T1056.002GUI Input CaptureEvidence1

T1560Archive Collected DataEvidence1

The encryption process puts each file in an individual ZIP archive that is password protected

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The get_inj_list action retrieves the targeted apps with overlays from the C&C server

Impact

2 techniques

T1485Data DestructionEvidence1

The ransomware also includes a new highly annoying capability that deletes the contacts in the contact list of the infected device... This code snippet shows the deletion of all the contacts: deleteContacts()

T1486Data Encrypted for ImpactEvidence1

MysteryBot also embeds a ransomware feature allowing itself to encrypt individually all files in the external storage directory, including every sub directory, after which the original files are deleted.

INDICATORS OF COMPROMISE

IOCs tracked for this family

34 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

32 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 months ago

domain●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

threatfabric blogNews

Jul 1, 2020

BlackRock - the Trojan that wanted to get them all

LokiBot-based Android banking trojan variant with upgrades for newer Android versions and improved information theft.

threatfabric blogNews

Jun 1, 2018

MysteryBot; a new Android banking Trojan ready for Android 7 and 8

Android banking malware that performs overlay attacks against banking and other apps, logs keystrokes via touch-point interception, deletes contacts, may collect email, and includes ransomware functionality that encrypts files into password-protected ZIP archives and deletes the originals.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching34

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

MysteryBot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1546.008Accessibility FeaturesEvidence1

When the malware is first launched on the device, it will start by hiding its icon from the app drawer... As second step it asks the victim for the Accessibility Service privileges.

Privilege Escalation

1 technique

T1546.008Accessibility FeaturesEvidence1

When the malware is first launched on the device, it will start by hiding its icon from the app drawer... As second step it asks the victim for the Accessibility Service privileges.

Stealth

1 technique

T1070.004File DeletionEvidence1

after which the original files are deleted... zipFile . addFiles ( paths , zipParameters ) ; file . delete ( )

Credential Access

3 techniques

T1056Input CaptureEvidence1

T1056.001KeyloggingEvidence1

T1056.002GUI Input CaptureEvidence1

Discovery

2 techniques

T1010Application Window DiscoveryEvidence1

public void getLastUsedApplication ( ) { ... List usageStatsList = ( ( UsageStatsManager ) usageStatsManager ) . queryUsageStats ... String packageName = ... getPackageName ( ) ;

T1083File and Directory DiscoveryEvidence1

Collection

4 techniques

T1056Input CaptureEvidence1

T1056.001KeyloggingEvidence1

T1056.002GUI Input CaptureEvidence1

T1560Archive Collected DataEvidence1

The encryption process puts each file in an individual ZIP archive that is password protected

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The get_inj_list action retrieves the targeted apps with overlays from the C&C server

Impact

2 techniques

T1485Data DestructionEvidence1

T1486Data Encrypted for ImpactEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

34 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

32 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 months ago

domain●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

threatfabric blogNews

Jul 1, 2020

BlackRock - the Trojan that wanted to get them all

LokiBot-based Android banking trojan variant with upgrades for newer Android versions and improved information theft.

threatfabric blogNews

Jun 1, 2018

MysteryBot; a new Android banking Trojan ready for Android 7 and 8

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching34

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.