Loading malware…
AbereBot is an Android banking trojan that masquerades as Google Chrome and steals financial credentials and sensitive information from infected devices. Advertised on a Russian-speaking cybercriminal forum, it targets customers of more than 140 banks across 18 countries, alongside payment, cryptocurrency, and email services including PayPal, MobiKwik, Unocoin, and Gmail.
AbereBot abuses Android Accessibility Service permissions to monitor on-screen activity, enable additional permissions, and prevent users from modifying application settings. When targeted applications are opened, it displays counterfeit login pages through Android WebView overlays to harvest credentials. It checks device geolocation and retrieves geographically tailored phishing pages hosted on GitHub. The malware also collects contacts and installed-application lists, intercepts SMS messages to capture one-time passwords, and sends SMS messages to numbers specified by its operator. It can activate when the user launches the application or when the device receives an SMS or MMS message.
The trojan uses Telegram bot infrastructure for command-and-control communications and exfiltration of stolen information. It conceals its application icon after launch and employs code obfuscation, unusual class names, and AES-encrypted strings to hinder detection and reverse engineering. Its confirmed targets span Europe, North America, Asia, and Oceania. No specific named threat actor or confirmed initial distribution mechanism is established.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
.NET Stubs: Sowing the Seeds of Discord (PureCrypter) Aberebot AbstractEmu AdoBot 404 Keylogger Agent Tesla Amadey AsyncRAT Ave Maria BitRAT BluStealer Formbook LimeRAT Loki Password Stealer (PWS) Nanocore RAT Orcus RAT Quasar RAT Raccoon RedLine Stealer WhisperGate
Named as a notable example of malware targeting financial services/mobile banking during the pandemic.
Referenced as a similar Android banking trojan, particularly regarding planned Telegram-based C2 behavior.
Android banking trojan advertised on the Russian-speaking XSS cybercriminal forum and hosted on Telegram. The article cites it as an example of mobile banking malware in its discussion of SMS phishing, but does not explicitly document an AbereBot smishing campaign.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.