Resubmissions
18/07/2026, 15:52
260718-ta8bvsez7r1006/07/2026, 12:34
260706-prwbeafs5t1006/07/2026, 12:26
260706-pmpcase19w10Analysis
- max time kernel
150s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
- submitted
06/07/2026, 12:26
General
- Target ca0989544a1511c773cf4f9da165e77a3be6d3b86a7b5484558b274ddc79a4b1.apk
- Size 1.1MB
- Sample260706-pmpcase19w
- SHA256 ca0989544a1511c773cf4f9da165e77a3be6d3b86a7b5484558b274ddc79a4b1
Score
10/10
Malware Config
Signatures
- Family: MazarBot
MazarBOT is an Android banking trojan first seen in 2016.
- Android MazarBot payload 1 IoCs
- Removes its main activity from the application launcher 1 TTPs 1 IoCs
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads information about phone network operator. 1 TTPs
Processes
-
com.qzhaswptmd.abtjut1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Acquires the wake lock
- Queries information about active data network
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
veujwlbpb.jar.cur.prof
veujwlbpb.jar
veujwlbpb.jar