Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Malware

Mamont

Mamont is an Android banking Trojan family first observed at the end of 2023 and heavily active through 2024, 2025, and Q1 2026. It is repeatedly described as the dominant mobile banking Trojan family in Kaspersky telemetry, accounting for 36.70% of mobile banker attacks in 2024, 61.85% of detected mobile banking Trojans in Q3 2025, and 73.5% of banking Trojan activity in Q1 2026. The malware is distributed mostly in Russia and the CIS, with multiple reports stating campaigns targeted Android users in Russia; one analyzed variant was also disguised as a dating app targeting Uzbek-speaking users.

Mamont is commonly delivered through social-engineering lures. Reported infection vectors include instant messages asking victims to identify a person in a photo, fake offers of free household appliances in neighborhood chats, and a late-2024 scheme in which scammers advertised discounted or wholesale goods, moved victims into Telegram chats, then sent a phishing link to an APK masquerading as a parcel-tracking app. In that campaign, victims were given a tracking number to enter into the app, and Kaspersky reported more than 31,000 blocked attacks in October and November 2024. A specific sample in that scheme was associated with MD5 12936056e8895e6a662731c798b27333, and apisys003[.]com was identified as a command-and-control server. Another analyzed Mamont campaign used a fake dating app named Tanishuv distributed from https://humouz.xyz/Tanishuv.apk; the primary APK SHA-256 was 0f12f7110022d27bd8bf46172a469fb78b15d79bd7cffca94cac8101dcb6065e and it decrypted and installed a second-stage payload with SHA-256 60720498750e7d36694d1ba4cf10dabe7aa733c423703225f5a9fd3be9ffaa6e. That sample communicated with C2 at http://84.21.189.36:2288.

Capabilities described across the reports include requesting permissions for background execution, notifications, SMS, calls, and phone-state access; intercepting push notifications; stealing SMS messages including messages from the previous three days; sending SMS messages; issuing USSD requests from primary or secondary SIMs; placing calls; collecting device information, installed apps, phone numbers, SIM and operator details; harvesting bank card data; and exfiltrating one-time codes from SMS or banking notifications. Mamont receives remote commands over a WebSocket channel using JSON commands such as call, callTwo, sms, smsTwo, oldsms, hide, show, changeIcon, custom, and photo. These commands allow the operators to send USSD requests, send SMS, hide or alter the app icon, prompt victims for arbitrary input, and collect photos from the device. Reports assess the custom and photo functionality as enabling additional social-engineering fraud, including impersonation of regulators or law enforcement.

One dissected Mamont sample functioned as a modular multi-stage dropper. It unpacked an embedded data.bin file into a second APK, silently installed it, and launched it. The companion malware requested READ_SMS, SEND_SMS, READ_PHONE_NUMBERS, READ_PHONE_STATE, CALL_PHONE, and POST_NOTIFICATIONS permissions, parsed SMS content for financial terms in Uzbek, Russian, and English, extracted amounts from banking alerts, and supported SMS-based financial fraud.

Mamont is tracked by detections such as Trojan-Banker.AndroidOS.Mamont, including variants such as Mamont.bc, Mamont.jo, Mamont.jx, and Mamont.jg. The content does not attribute Mamont to a named threat actor, but consistently associates it with financially motivated Android campaigns targeting banking users, especially in Russia and nearby regions.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1566PhishingEvidence3

The link directed users to a phishing site offering to download Mamont for Android.

T1566.002Spearphishing LinkEvidence1

Distribution URL: https://humouz.xyz/Tanishuv.apk (insecure, suspicious domain)

Execution

3 techniques
T1106Native APIEvidence1

The app’s flow is designed to silently install this second APK and immediately launch its MainActivity.

T1204User ExecutionEvidence1

Distribution URL: https://humouz.xyz/Tanishuv.apk ... Although the app identifies itself as a dating platform ... its main purpose is to unpack and install a hidden companion malware.

T1204.002Malicious FileEvidence4

Its distribution schemes are ranging from ages-old “Is that you in the picture?” scams to complex social engineering plots with fake stores and delivery tracking apps.

Stealth

5 techniques
T1027Obfuscated Files or InformationEvidence1

the command and control (C2) server, whose address (http://84.21.189.36:2288) is stored base64encoded within the code

T1036MasqueradingEvidence3

The attackers would then send what appeared to be the photo itself but was actually a malware installer... In reality, this was malware with no parcel-tracking functionality whatsoever.

T1140Deobfuscate/Decode Files or InformationEvidence1

Once installed, the primary app extracts an embedded file named data.bin from res/raw/ and decrypts it into a second APK.

T1497.001System ChecksEvidence1

After installation, a broadcast receiver (InstallReceiver) starts PackagePoller PackagePoller repeatedly attempts to launch the companion malware’s main activity

T1564Hide ArtifactsEvidence2

changeIcon Changes the app icon... transparent if set to true... hide Hides the app icon... show Restores the original app icon.

Credential Access

3 techniques
T1056Input CaptureEvidence4

When the app receives that command, the user sees a window with a text box for entering data, which is then sent to the command-and-control server.

T1528Steal Application Access TokenEvidence1

the Trojan begins to intercept all push notifications received by the device (for example, confirmation codes for banking transactions) and forward them to the attackers’ server.

T1649Steal or Forge Authentication CertificatesEvidence2

The first one hijacks all push notifications and forwards them to the attackers’ server.

Discovery

3 techniques
T1082System Information DiscoveryEvidence1

The malware gathers sensitive device information, including installed apps, phone numbers, and operator/SIM details

T1497.001System ChecksEvidence1

After installation, a broadcast receiver (InstallReceiver) starts PackagePoller PackagePoller repeatedly attempts to launch the companion malware’s main activity

T1518Software DiscoveryEvidence1

The malware gathers sensitive device information, including installed apps, phone numbers, and operator/SIM details through components like InstalledAppsCollector

Collection

2 techniques
T1005Data from Local SystemEvidence3

photo Runs an activity that uploads a photo from the gallery.

T1056Input CaptureEvidence4

When the app receives that command, the user sees a window with a text box for entering data, which is then sent to the command-and-control server.

Command and Control

2 techniques
T1071Application Layer ProtocolEvidence2

It then asks the victim to enter the tracking number previously received from the scammers, and sends a POST request containing device information along with the number to the C2 server... The other one sets up a connection with the attackers’ WebSocket server.

T1105Ingress Tool TransferEvidence2

The rise in Trojan droppers is also linked to them: these droppers are primarily designed to deliver banking Trojans.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence3

The first one hijacks all push notifications and forwards them to the attackers’ server... The result of the request is forwarded to the C2... the user sees a window with a text box for entering data, which is then sent to the command-and-control server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app3 months ago
hash.sha256●●●●●●●●●●●●View more in app3 months ago
hash.sha256●●●●●●●●●●●●View more in app3 months ago
uri●●●●●●●●●●●●View more in app3 months ago
uri●●●●●●●●●●●●View more in app3 months ago
ip.v4●●●●●●●●●●●●View more in app3 months ago
ACTIVITY FEED

Recent activity

12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.