Malware

Asacub

Asacub is an Android banking Trojan that became one of the most prevalent mobile financial malware families targeting users, particularly in Russia and later other regions. It is associated with mobile banking fraud and is known for masquerading as legitimate applications, including clients for popular classified-ad and free ads services, to deceive users into installation.

Asacub collects a broad set of victim data from compromised devices. Documented capabilities include harvesting SMS messages as they are received, sending SMS messages from the infected device, stealing the device contact list, and gathering device profiling information such as model, operating system version, and mobile network operator details. Its command-and-control communications have used HTTP POST requests, blending with ordinary application-layer traffic.

The malware’s SMS access supports both fraud and account takeover workflows common to Android banking malware, including abuse of mobile banking and interception of sensitive communications. Its contact and device-information collection also supports victim profiling and operational control. Asacub has been repeatedly identified in mobile threat reporting as a major Android banking malware family and remained a leading Android banking threat by victim share as late as 2020.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

MORE EFFECTIVE DISTRIBUTION Contextual advertising “Partner” programs Exploits

Stealth

1 technique

T1036MasqueradingEvidence1

Agent Smith can impersonate any popular application on an infected device, and the core malware disguises itself as a legitimate Google application.

Credential Access

2 techniques

T1056Input CaptureEvidence1

This study analyzes the banking malware that steals the credentials used to access online banking or payment system accounts and to intercept one-time passwords.

T1649Steal or Forge Authentication CertificatesEvidence1

This has been the dominant method in recent years... mimics the bank’s login page and reels in the victim’s credentials.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.

Collection

1 technique

T1056Input CaptureEvidence1

This study analyzes the banking malware that steals the credentials used to access online banking or payment system accounts and to intercept one-time passwords.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence2

AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.

ACTIVITY FEED

Recent activity

19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

19 SOURCESView more in app

slideshareNews

Jan 1, 2026

Hi-Tech Crime Trends 2016 | PDF

Android banking trojan listed in the expanding Android trojan market; appears in both Europe/USA and Russia lists.

mitre attack websiteNews

Oct 21, 2021

Masquerade as Legitimate Application, Technique T1444 - Mobile | MITRE ATT&CK®

Android banking trojan that disguises itself as a client for popular free advertising services.

mitre attack websiteNews

Oct 21, 2021

Capture SMS Messages, Technique T1412 - Mobile | MITRE ATT&CK®

Android banking trojan that collects incoming SMS messages.

mitre attack websiteNews

Oct 21, 2021

Standard Application Layer Protocol, Technique T1437 - Mobile | MITRE ATT&CK®

Mobile banking trojan that communicates with command-and-control infrastructure over HTTP POST.

+15 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Asacub