Threat video1:00
RemControl Android Banking Trojan MaaS: Detection & IOCs
RemControl sells Android banking overlays as malware-as-a-service, hitting 30+ banks. Its 31 IOCs and 9 detection rules include a free Splunk SPL rule.
Read the full threat intel for RemControl Android Banking Trojan MaaS: Detection & IOCs →
Chapters
- 0:00The hookA banking trojan overlays 30+ institutions.
- 0:04The storyFake Google Play pages impersonate TVTap.
- 0:11Attack pathProxy C2 domain registered in May.
- 0:25AttributionAttributed to UNKK.
- 0:30Indicators of compromise30 indicators to hunt: 2 IPs, 7 domains and 3 URLs, and more.
- 0:36MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to exfiltration.
- 0:42Remediation5 steps now: Block the listed domains, IPs and fake TVTap distribution URLs.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A banking trojan overlays 30+ institutions.
0:05Fake Google Play pages impersonate TVTap.
0:08Meta ads send victims there.
0:11Proxy C2 domain registered in May.
0:14Ads lure users, who sideload the app.
0:16A local VPN keeps Play Protect from scanning.
0:20Phishing overlays, then remote control.
0:25Attributed to UNKK. Confidence: low.
0:3030 indicators to hunt: 2 IPs, 7 domains and 3 URLs, and more.
0:3716 ATT&CK techniques, from resource development to exfiltration.
0:425 steps now: Block the listed domains, IPs and fake TVTap distribution URLs.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.