Resubmissions
18/07/2026, 15:52
260718-ta8bvsez7r1006/07/2026, 12:34
260706-prwbeafs5t1006/07/2026, 12:26
260706-pmpcase19w10Analysis
- max time kernel
149s - max time network
152s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
- submitted
06/07/2026, 12:26
General
- Target ca0989544a1511c773cf4f9da165e77a3be6d3b86a7b5484558b274ddc79a4b1.apk
- Size 1.1MB
- Sample260706-pmpcase19w
- SHA256 ca0989544a1511c773cf4f9da165e77a3be6d3b86a7b5484558b274ddc79a4b1
Score
10/10
Malware Config
Signatures
- Family: MazarBot
MazarBOT is an Android banking trojan first seen in 2016.
- Android MazarBot payload 1 IoCs
- Removes its main activity from the application launcher 1 TTPs 1 IoCs
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Tries to add a device administrator. 2 TTPs 1 IoCs
Processes
-
com.qzhaswptmd.abtjut1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Acquires the wake lock
- Queries information about active data network
- Tries to add a device administrator.
Network
MITRE ATT&CK Mobile v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Replay Monitor
Loading Replay Monitor...
Downloads
veujwlbpb.jar
veujwlbpb.jar