Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight
Threat Actors
Malware Families
Excerpt
Executive Summary Cyble Research and Intelligence Labs (CRIL) has identified a novel Android banking trojan, dubbed OverlayPhantom, actively distributed in the wild via malicious URLs. The malware employs a two-stage infection chain, using a dropper application that impersonates trusted platforms, including the official Austrian government identity application, ID Austria, and the widely used consumer platform TikTok, to deceive victims into installing it. Once deployed,…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | f8b614a2918378063d6e6655b676ceb52ae65b1510e2cc08087fcac31acb7aeb | Medium | Score 51/100 | First seen |
| SHA256 | 9ef37376bfaa18e193cc72218924ad8ebf56d2667d348f0eae5ae6ec45ab8775 | Medium | Score 51/100 | First seen |
| URL | https://bitlrewards-app.com/api/download/IDAustria | High | Score 58/100 | First seen |
| SHA256 | 8ddc1f2a75f3d5b5bd054a5367bd5015ebc90f3453d63c7cce438c12dc2ae86a | High | Score 70/100 | First seen |
| URL | https://199.217.99.122 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…