Threat video1:00
GhostBat RAT Android Ghost Overlay: Detection & IOCs
GhostBat abuses Accessibility to lift UPI PINs through a Ghost Overlay: 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for GhostBat RAT Android Ghost Overlay: Detection & IOCs →
Chapters
- 0:00The hookGhost overlay targets 60 banking apps.
- 0:04The storyFake traffic-fine SMS.
- 0:10Attack pathReported fake traffic-fine links trick users.
- 0:24AttributionNo threat actor is attributed.
- 0:28Indicators of compromise6 indicators to hunt: 1 domain, 1 SHA-256 hash and 3 file names, and more.
- 0:37MITRE ATT&CK techniques13 ATT&CK techniques, from initial access to exfiltration.
- 0:42Remediation4 steps now: Block api[.]cloudsettle[.]org at DNS/proxy and alert on any device contacting.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Ghost overlay targets 60 banking apps.
0:05Fake traffic-fine SMS.
0:06Ghost steals the PIN.
0:10Reported fake traffic-fine links trick users.
0:13APK unpacks obfuscated modules.
0:16Seeks Accessibility, monitors apps.
0:19Ghost overlay captures PIN and SMS.
0:24No threat actor is attributed. Confidence: low.
0:296 indicators to hunt: 1 domain, 1 SHA-256 hash and 3 file names, and more.
0:3713 ATT&CK techniques, from initial access to exfiltration.
0:424 steps now: Block api[.]cloudsettle[.]org at DNS/proxy and alert on any device contacting.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.