{
	"id": "6b04b2de-9a01-484c-809a-394b07e05a6a",
	"created_at": "2026-04-06T00:15:54.285578Z",
	"updated_at": "2026-04-10T03:20:32.381223Z",
	"deleted_at": null,
	"sha1_hash": "73d670df6ba2652a4ff0b869c5c654c8e2f486ba",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 47455,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 22:43:37 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool MysteryBot\r\n Tool: MysteryBot\r\nNames MysteryBot\r\nCategory Malware\r\nType Banking trojan\r\nDescription\r\n(Threat Fabric) While processing our daily set of suspicious samples, our detection rule for the Android banking tr\r\nLokiBot matched a sample that seemed quite different than LokiBot itself, urging us to take a closer look at it. Loo\r\nat the bot commands, we first thought that LokiBot had been improved. However, we quickly realized that there is\r\nmore going on: the name of the bot and the name of the panel changed to 'MysteryBot', even the network\r\ncommunication changed.\r\nDuring investigation of its network activity we found out that MysteryBot and LokiBot Android banker are both\r\nrunning on the same C\u0026C server. This quickly brought us to an early conclusion that this newly discovered Malw\r\neither an update to Lokibot, either another banking trojan developed by the same actor.\r\nInformation \u003chttps://www.threatfabric.com/blogs/mysterybot__a_new_android_banking_trojan_ready_for_android_7_and_8.h\r\nMalpedia \u003chttps://malpedia.caad.fkie.fraunhofer.de/details/apk.mysterybot\u003e\r\nAlienVault OTX \u003chttps://otx.alienvault.com/browse/pulses?q=tag:MysteryBot\u003e\r\nLast change to this tool card: 21 May 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool MysteryBot\r\nChanged Name Country Observed\r\nUnknown groups\r\n  _[ Interesting malware not linked to an actor yet ]_  \r\n1 group listed (0 APT, 0 other, 1 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8131616a-548c-48a4-98ed-6b043afee311\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8131616a-548c-48a4-98ed-6b043afee311\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8131616a-548c-48a4-98ed-6b043afee311"
	],
	"report_names": [
		"listgroups.cgi?u=8131616a-548c-48a4-98ed-6b043afee311"
	],
	"threat_actors": [],
	"ts_created_at": 1775434554,
	"ts_updated_at": 1775791232,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/73d670df6ba2652a4ff0b869c5c654c8e2f486ba.pdf",
		"text": "https://archive.orkl.eu/73d670df6ba2652a4ff0b869c5c654c8e2f486ba.txt",
		"img": "https://archive.orkl.eu/73d670df6ba2652a4ff0b869c5c654c8e2f486ba.jpg"
	}
}