Mamont
Mamont is an Android banking Trojan family first observed at the end of 2023 and heavily active through 2024, 2025, and Q1 2026. It is repeatedly described as the dominant mobile banking Trojan family in Kaspersky telemetry, accounting for 36.70% of mobile banker attacks in 2024, 61.85% of detected mobile banking Trojans in Q3 2025, and 73.5% of banking Trojan activity in Q1 2026. The malware is distributed mostly in Russia and the CIS, with multiple reports stating campaigns targeted Android users in Russia; one analyzed variant was also disguised as a dating app targeting Uzbek-speaking users.
Mamont is commonly delivered through social-engineering lures. Reported infection vectors include instant messages asking victims to identify a person in a photo, fake offers of free household appliances in neighborhood chats, and a late-2024 scheme in which scammers advertised discounted or wholesale goods, moved victims into Telegram chats, then sent a phishing link to an APK masquerading as a parcel-tracking app. In that campaign, victims were given a tracking number to enter into the app, and Kaspersky reported more than 31,000 blocked attacks in October and November 2024. A specific sample in that scheme was associated with MD5 12936056e8895e6a662731c798b27333, and apisys003[.]com was identified as a command-and-control server. Another analyzed Mamont campaign used a fake dating app named Tanishuv distributed from https://humouz.xyz/Tanishuv.apk; the primary APK SHA-256 was 0f12f7110022d27bd8bf46172a469fb78b15d79bd7cffca94cac8101dcb6065e and it decrypted and installed a second-stage payload with SHA-256 60720498750e7d36694d1ba4cf10dabe7aa733c423703225f5a9fd3be9ffaa6e. That sample communicated with C2 at http://84.21.189.36:2288.
Capabilities described across the reports include requesting permissions for background execution, notifications, SMS, calls, and phone-state access; intercepting push notifications; stealing SMS messages including messages from the previous three days; sending SMS messages; issuing USSD requests from primary or secondary SIMs; placing calls; collecting device information, installed apps, phone numbers, SIM and operator details; harvesting bank card data; and exfiltrating one-time codes from SMS or banking notifications. Mamont receives remote commands over a WebSocket channel using JSON commands such as call, callTwo, sms, smsTwo, oldsms, hide, show, changeIcon, custom, and photo. These commands allow the operators to send USSD requests, send SMS, hide or alter the app icon, prompt victims for arbitrary input, and collect photos from the device. Reports assess the custom and photo functionality as enabling additional social-engineering fraud, including impersonation of regulators or law enforcement.
One dissected Mamont sample functioned as a modular multi-stage dropper. It unpacked an embedded data.bin file into a second APK, silently installed it, and launched it. The companion malware requested READ_SMS, SEND_SMS, READ_PHONE_NUMBERS, READ_PHONE_STATE, CALL_PHONE, and POST_NOTIFICATIONS permissions, parsed SMS content for financial terms in Uzbek, Russian, and English, extracted amounts from banking alerts, and supported SMS-based financial fraud.
Mamont is tracked by detections such as Trojan-Banker.AndroidOS.Mamont, including variants such as Mamont.bc, Mamont.jo, Mamont.jx, and Mamont.jg. The content does not attribute Mamont to a named threat actor, but consistently associates it with financially motivated Android campaigns targeting banking users, especially in Russia and nearby regions.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
The app’s flow is designed to silently install this second APK and immediately launch its MainActivity.
Stealth
5 techniques
Stealth
the command and control (C2) server, whose address (http://84.21.189.36:2288) is stored base64encoded within the code
The attackers would then send what appeared to be the photo itself but was actually a malware installer... In reality, this was malware with no parcel-tracking functionality whatsoever.
Once installed, the primary app extracts an embedded file named data.bin from res/raw/ and decrypts it into a second APK.
Credential Access
3 techniques
Credential Access
When the app receives that command, the user sees a window with a text box for entering data, which is then sent to the command-and-control server.
Discovery
3 techniques
Discovery
The malware gathers sensitive device information, including installed apps, phone numbers, and operator/SIM details
Collection
2 techniques
Collection
Command and Control
2 techniques
Command and Control
It then asks the victim to enter the tracking number previously received from the scammers, and sends a POST request containing device information along with the number to the C2 server... The other one sets up a connection with the attackers’ WebSocket server.
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Dominant Android banking trojan family in the quarter, accounting for most detected mobile banking trojan packages and many of the top banker variants by attacked users.
Android banking malware delivered here via a dropper disguised as a dating app. It installs a secondary APK that steals SMS messages, extracts banking-related data, gathers device and SIM information, communicates with a C2 server, and can send SMS messages and place calls for fraud and account takeover.
Extensive Android banking trojan family that intercepts SMS one-time codes and steals payment card/banking data and other sensitive information; heavily modified and iterated by operators.
Mamont is a mobile banking trojan prevalent in Q2 2025, distributed via Google Play by masquerading as legitimate apps and used to steal banking credentials.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.