Threat video1:00
Mirax Android DTO RAT Banking Fraud: Detection & IOCs
Mirax abuses Android Accessibility Services to drive banking apps remotely, with 26 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for Mirax Android DTO RAT Banking Fraud: Detection & IOCs →
Chapters
- 0:00The hookMirax infected thousands of Android phones.
- 0:04The storySold to vetted affiliates since December.
- 0:11Attack pathStreaming apps lead victims to a dropper.
- 0:24AttributionAttributed to MiraxBot.
- 0:28Indicators of compromise24 indicators to hunt: 2 domains, 20 SHA-1 hashes and 1 file name, and more.
- 0:36MITRE ATT&CK techniques19 ATT&CK techniques, from persistence to exfiltration.
- 0:41Remediation4 steps now: Block oscofneuid[.]com and kenobuias[.]com at DNS/proxy and hunt for them.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Mirax infected thousands of Android phones.
0:05Sold to vetted affiliates since December.
0:07Infections ran through September.
0:11Streaming apps lead victims to a dropper.
0:13It downloads malware posing as Google Play Services.
0:17It prompts for Accessibility and steals OTP codes.
0:24Attributed to MiraxBot. Confidence: low.
0:2924 indicators to hunt: 2 domains, 20 SHA-1 hashes and 1 file name, and more.
0:3719 ATT&CK techniques, from persistence to exfiltration.
0:424 steps now: Block oscofneuid[.]com and kenobuias[.]com at DNS/proxy and hunt for them.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.