RemoMalware
- playpraetor
Last reported 10 months ago, by Group-IB1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1056.001Keylogging
“Abuse accessibility for keylogging, reading UI content, performing gestures.”
- T1204.005Malicious Library
“It is important to note that the malicious library requires the original application to be embedded within the assets folder of the modified application.”
- T1684Social Engineering
“In another example, the group used social engineering tactics to target owners of food and beverage businesses.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Hook for Gold: Inside GoldFactory’s Сampaign That Turns Apps Into Goldmines“Cybercriminals used Gigabud, Remo, MMRat and Gigaflower to install infected banking applications.”
Indicators in its reports
named in the reports above- ykkadm[.]icuin 1 report
- dgpyynxzb[.]comin 1 report
- d3752e85216f46b7…9dcc65f09723in 1 report
- 4b6211de6a9b8b78…dbd5e6d3e360in 1 report
- d75ca4b69e3ad9a6…4c24174d25c4in 1 report
- d47246c9bd4961f6…eb47077fd897in 1 report
- 0de69fad50b9e080…3544b0a46139in 1 report
- 68fb18d67bb2314f…62809429ad99in 1 report
- 9ada0f54f0eaa034…f96d6f095a43in 1 report
- 4eb7a289af4ea7c6…1634c23a03a9in 1 report
- ynsftkg[.]topin 1 report
- b-ty[.]comin 1 report
- www.vvpolo[.]topin 1 report
- baknx[.]xyzin 1 report
- nxbcak[.]xyzin 1 report
- zoyee[.]cnin 1 report
- evnspccskh[.]comin 1 report
- 47.236.246[.]131in 1 report
- 47.237.9[.]119in 1 report
- 13.214.19[.]168in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.