Exobot
The MITRE Corporation
· Published 29/10/2020 14:32 · Modified 27/03/2026 01:41
Family
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 29/10/2020 14:32
- Modified
- 27/03/2026 01:41
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 21 attack patterns (mitre), 1 intrusion sets (apt), 2 sectors, 4 countries, 15 indicators
Description
[Exobot](https://attack.mitre.org/software/S0522) is Android banking malware, primarily targeting financial institutions in Germany, Austria, and France.(Citation: Threat Fabric Exobot)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (21)
-
Keylogging uses
-
SMS Control usesT1582 MITRE
-
T1012 usesQuery Registry MITRE
-
GUI Input Capture uses
-
-
T1081 uses
-
T1422 MITRE
-
Web Protocols uses
-
-
T1113 usesScreen Capture MITRE
-
SMS Messages uses
-
Broadcast Receivers uses
Intrusion sets (APT) (1)
-
Coper usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (2)
-
Finance targets
-
Technology targets
Countries (4)
-
Türkiye targets
-
Portugal targets
-
Spain targets
-
United States of America targets
Indicators (15)
-
https://2.57.149.150/ZTIwNDEzZjM4YjYw/indicatesstix 100/100 Revoked· Valid until 22/04/2024 · Source: AlienVault -
https://185.198.69.111/NTBiZmM4ZDQ2MWY2/indicatesstix 100/100 Revoked· Valid until 22/04/2024 · Source: AlienVault -
karmelinanoonethousandbaby.netindicatesstix 100/100 Revoked· Valid until 31/12/2024 · Source: AlienVault -
sanagerekkalmaz1453.shopindicatesstix 100/100 Revoked· Valid until 31/12/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 22/04/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 22/04/2024 · Source: AlienVault
-
https://83.97.73.195/MzZhMGJjZTJkOGI3/indicatesstix 100/100 Revoked· Valid until 22/04/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 22/04/2024 · Source: AlienVault
-
https://91.240.118.224/NjQyNDcyMjE3ZWU3/indicatesstix 100/100 Revoked· Valid until 22/04/2024 · Source: AlienVault