{
	"id": "c55625fe-918d-4e36-a69e-ced7414a02c6",
	"created_at": "2026-04-06T00:09:06.042668Z",
	"updated_at": "2026-04-10T03:21:20.038531Z",
	"deleted_at": null,
	"sha1_hash": "bdfaad7ab31b6cd17866d0a409f3aff533f28342",
	"title": "MysteryBot; a new Android banking Trojan ready for Android 7 and 8",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 30766,
	"plain_text": "MysteryBot; a new Android banking Trojan ready for Android 7\r\nand 8\r\nPublished: 2024-10-01 · Archived: 2026-04-05 17:31:25 UTC\r\nIntro\r\nWhile processing our daily set of suspicious samples, our detection rule for the Android banking trojan LokiBot\r\nmatched a sample that seemed quite different than LokiBot itself, urging us to take a closer look at it. Looking at\r\nthe bot commands, we first thought that LokiBot had been improved. However, we quickly realized that there is\r\nmore going on: the name of the bot and the name of the panel changed to “MysteryBot”, even the network\r\ncommunication changed.\r\nDuring investigation of its network activity we found out that MysteryBot and LokiBot Android banker are both\r\nrunning on the same C\u0026C server. This quickly brought us to an early conclusion that this newly discovered\r\nMalware is either an update to Lokibot, either another banking trojan developed by the same actor.\r\nTo consolidate evidence, we searched some other sources and found more matches between samples of both\r\nmalware using the same C\u0026C, as visible in following screenshot from Koodous:\r\nSource: https://www.threatfabric.com/blogs/mysterybot__a_new_android_banking_trojan_ready_for_android_7_and_8.html\r\nhttps://www.threatfabric.com/blogs/mysterybot__a_new_android_banking_trojan_ready_for_android_7_and_8.html\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA",
		"Malpedia"
	],
	"references": [
		"https://www.threatfabric.com/blogs/mysterybot__a_new_android_banking_trojan_ready_for_android_7_and_8.html"
	],
	"report_names": [
		"mysterybot__a_new_android_banking_trojan_ready_for_android_7_and_8.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434146,
	"ts_updated_at": 1775791280,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/bdfaad7ab31b6cd17866d0a409f3aff533f28342.pdf",
		"text": "https://archive.orkl.eu/bdfaad7ab31b6cd17866d0a409f3aff533f28342.txt",
		"img": "https://archive.orkl.eu/bdfaad7ab31b6cd17866d0a409f3aff533f28342.jpg"
	}
}