ctrlINT What the industry said about every indicator, with the quote

TgToxicMalware

According to Trend Micro, TgToxic has been used in an ongoing campaign that has been targeting Android users in Southeast Asia since July 2022. Goal of the campaign is to steal victims’ assets from finance and banking applications (such as cryptocurrency wallets, credentials for official bank apps on mobile, and money in deposit), via a banking trojan they named TgToxic (based on its special…From MISP Galaxy

Last reported 3 years ago, by Group-IB1 report

ATT&CK techniques

2 techniques · each with the sentence it comes from
  1. T1036Masquerading

    “GoldDigger spreads via fake websites masquerading as Google Play pages and fake corporate websites in Vietnam.”

    Group-IBVendor
  2. T1056.001Keylogging

    “This means it can see the victim’s balance, harvest the second credential issued for two-factor authentication, and implement keylogging functions, allowing it to capture credentials.”

    Group-IBVendor

What the reports say

1 report, newest first · the exact sentence from each

  1. “…r noteworthy Android malware families currently targeting the region include the Gigabud family, SpyNote, HookBot, PWNDROID4, CraxsRAT, TgToxic, and Anubis (Godfather’s  predecessor), etc.”

    Group-IBVendor
    Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with TgToxic here?
No account needed. We do not store your IP address.