GustuffMalware
Group-IB describes Gustuff as a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular ecommerce websites and marketplaces. Gustuff has previously never been reported.From MISP Galaxy
Last reported 3 years ago, by Group-IB3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1036Masquerading
“Active since at least July 2022, Gigabud.Loan has been masquerading as applications of fictional financial institutions from Thailand, Indonesia, and Peru.”
- T1056.001Keylogging
“The latest Gigabud versions contain another feature that abuses accessibility services – a new keylogging module that allows preparing the specific password-stealing scheme for each targeted banking application.”
- T1684Social Engineering
“This combination of social engineering and permission exploitation underscores the significance of user awareness and caution when encountering unexpected or suspicious requests, safeguarding against the potential infiltration of dangerous malware.”
What the reports say
3 reports, newest first · the exact sentence from each-
Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix“Regrettably, certain banking Trojans, such as Gustuff and Gigabud, are exploiting this feature.”
-
Breaking down Gigabud banking malware with Group-IB Fraud Matrix“…s, similar to screen capturing, are now being leveraged as a means of exploitation by threat actors by several banking trojans, such as Gustuff and Gigabud.”
-
Gustuff: Weapon of Mass Infection“Gustuff: Weapon of Mass Infection”
Indicators in its reports
named in the reports above- ks8cb[.]ccin 1 report
- ms2ve[.]ccin 1 report
- zu7kt[.]ccin 1 report
- d8834a21bc70fbe2…e35be1b7276bin 1 report
- hds6y[.]ccin 1 report
- smgeo[.]ccin 1 report
- www.dg1e[.]comin 1 report
- wbke[.]ccin 1 report
- c2b91a1d4b3d1dff…7320709230a1in 1 report
- 139a5bcc92044e2e…abac6a1634bcin 1 report
- 569626b0b6ef277c…ac492fb4e6a7in 1 report
- 6171db5548941aff…9b72fcffbb60in 1 report
- 0ffd769fec531474…972dd82414f5in 1 report
- 6a8c601ba5a0eaeb…11bd07457407in 1 report
- 43d058aacb210c33…9e233b3f1cd4in 1 report
- 03b30ad69bd7c4ef…db6b46fb6164in 1 report
- b80a297daeb4ae11…5ceeff53267cin 1 report
- 380abc14ee41ad14…8d8f86287427in 1 report
- 5827a6e0251a095b…e9f48fe61ff1in 1 report
- fbb2ec92e725740c…14aab6cfb0e3in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.