mazarbot | ca0989544a1511c773cf4f9da165e77a3be6d3b86a7b5484558b274ddc79a4b1

Resubmissions

18/07/2026, 15:52

260718-ta8bvsez7r10

06/07/2026, 12:34

260706-prwbeafs5t10

06/07/2026, 12:26

260706-pmpcase19w10

Analysis

max time kernel
149s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
06/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca0989544a1511c773cf4f9da165e77a3be6d3b86a7b5484558b274ddc79a4b1.apk
Size 1.1MB
Sample260706-pmpcase19w
SHA256 ca0989544a1511c773cf4f9da165e77a3be6d3b86a7b5484558b274ddc79a4b1
MD5 26f529d46558a35cd93b3f6dc85a213f
SHA1 f3c68a5859d92d3048169dd28da19bb105aa0da5
SHA512 56173d3d3ff48ef7a43428ae66a1187a83a2064d0cf3fdb6def5f917e9bc050998a347c131ee88b18750e8ce12689a46adad482e5f0735bba91bec93d024c5ed
SSDEEP 24576:wqJONrJCTE3x0yCcmMvJO4kc1NWEz1T7hwRq4OaNF:wqJOlt3GyCivJoUII1HhQvOGF
TLSH
T19835C0C372699096FCB2D9714094C48F9E1E6E94CCACAB5E1F406C815F77DCA3ED6888
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection discovery evasion mazarbot impact infostealer privilege_escalation stealth trojan

Malware Config

Signatures

Family: MazarBot
MazarBOT is an Android banking trojan first seen in 2016.
trojan infostealer mazarbot

Android MazarBot payload 2 IoCs

resource	yara_rule
behavioral1/memory/4268-0.dex	family_mazarbot
behavioral1/memory/4243-0.dex	family_mazarbot

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4243	com.qzhaswptmd.abtjut

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.qzhaswptmd.abtjut/app_yobqpj/veujwlbpb.jar	4268	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qzhaswptmd.abtjut/app_yobqpj/veujwlbpb.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.qzhaswptmd.abtjut/app_yobqpj/oat/x86/veujwlbpb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qzhaswptmd.abtjut/app_yobqpj/veujwlbpb.jar	4243	com.qzhaswptmd.abtjut

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.qzhaswptmd.abtjut

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.qzhaswptmd.abtjut

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qzhaswptmd.abtjut

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.qzhaswptmd.abtjut

com.qzhaswptmd.abtjut
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Acquires the wake lock
- Queries information about active data network
- Tries to add a device administrator.
PID:4243
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qzhaswptmd.abtjut/app_yobqpj/veujwlbpb.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.qzhaswptmd.abtjut/app_yobqpj/oat/x86/veujwlbpb.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4268

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

veujwlbpb.jar.cur.prof

Path /data/data/com.qzhaswptmd.abtjut/app_yobqpj/oat/veujwlbpb.jar.cur.prof
Size 366B
SHA256 136bc74741fc630ae5dc3603ddd7724cf083be50ff068c6cafa2f24839ef0460
MD5 13cf3216a1603d3ac1f09b5ffbe2fb7b
SHA1 b64edb192ce28e0ca44538684f85e9a6bf502837
SHA512 c5092afd6f95ced28106ea5903b5fa9f5f8f9248da740aefce1a80dda31938a1529d10fa781c6fa7524bd9ee9016fe51a1051a87a02a6964587e467458b9c7be
TLSH
T1D9E0C0395D01115A022B9511858EF28FBBD8F2763EDDF310C22955413F341AC554272E
MD5 SHA1 SHA512 TLSH

Submit Download

veujwlbpb.jar

Path /data/data/com.qzhaswptmd.abtjut/app_yobqpj/veujwlbpb.jar
Size 505KB
SHA256 cd66b669be1a99c16d32d8c488a702c3dab660ccd45164ca0f8a27aabe1f30e6
MD5 f77218ce087763a9a0f915d5066f7518
SHA1 13b8b5605769af72050d2966fe81fa6cd7eebdb8
SHA512 f3cfc241807143fd74f7d618fb0dc0bca9c898f36d2184140e6bebe8af1382d92360fc3fbf7568b80737994bd926fa087f0da065012b933f303d7d12742d0b63
SSDEEP 12288:BwvXQOcxHUbDtL4FsacuZqlEhDc33yyV9OAO4fqqWoA:yINxHytcC4uqq3yyeA3qqWoA
TLSH
T102B42395D3AE2060F2110CF236DC856D75E9DEDE8281EC0FD9AECC6612D53A311A7397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

veujwlbpb.jar

Path /data/user/0/com.qzhaswptmd.abtjut/app_yobqpj/veujwlbpb.jar
Size 1.2MB
SHA256 55fb234a687f462ad632cded85a17578965ea569a4be4028d1a11607013f7110
MD5 d6b31eb36c94db5a959a5257cab637f6
SHA1 57859ddb41176886a14ebd0a851d9965007fe852
SHA512 1eba6543eeaddbb4ee0034d594afcfc0de9faa0fa6540df6635c712a2568037c577113be7337e3c505e6a10e0137b8428103852cd16eb9197ebea9ff62787495
SSDEEP 12288:HR9EYDRpwNZFkFpQtMzGagv+KOcvTHjloPaK92rCiVHeGWqiMND8XlhaW6CUWTu7:HRC3NMrc+PaK9KCiVS+WLU5d7
TLSH
T1D4457B12EE112F23D49D973316AB4BE2BB3A75011F13875706190A75FC4B2C19BFAB98
MD5 SHA1 SHA512 SSDEEP TLSH

Download

veujwlbpb.jar

Path /data/user/0/com.qzhaswptmd.abtjut/app_yobqpj/veujwlbpb.jar
Size 1.2MB
SHA256 37a018553f0fd9b1304cc400f5d566a7ff6606943fc2f1f98c8465054bdfee2a
MD5 1f90763017fe68888d0e983cda56002b
SHA1 92e039e1d7e880b42a559fa4fcf5da19e1b264b2
SHA512 9d1e4c757b0edd4dfc03db55aeeedf17cfe84f9026b6c18391b87b3422745ae53e1440f571bb722ddf61dddce0cfbdde155783d9944c9935709494f4923eebfc
SSDEEP 12288:HR9EYDRpwNZFkFpQtMzGagv+KOcvTHjloPaK92rCit7sflByfc6Ynmc8gmBs7TxS:HRC3NMrc+PaK9KCi934m6m+bB8d7
TLSH
T1DC457D12EE121F33C4DE933726AB4F62777939045B539747060A9E65BC073C1ABE9B88
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads