Malware

Rotexy

Rotexy is an Android banking Trojan that combines financial-fraud functionality with ransomware-style screen-locking behavior. It has been observed as a notable mobile banking malware family and was reported among the more prevalent Android banking threats in 2019 and 2020.

Rotexy targets Android devices and focuses heavily on SMS-based fraud workflows associated with banks, payment systems, and mobile network operators. It can monitor incoming SMS messages, filter them using sender information, keywords, and regular expressions, automatically reply to messages, optionally delete them, and transmit SMS content or full message lists to command-and-control infrastructure. These behaviors support interception of banking notifications and one-time codes, as well as concealment of attacker activity from the victim.

The malware also performs device profiling and data theft. Reported collection includes the device IMEI, phone number, network operator, operating system version, device model, registration country, and the victim’s contact list, which can be uploaded to its operators. For command and control, Rotexy has used JSON-formatted messages over HTTP POST and has also leveraged Google Cloud Messaging, indicating a flexible mobile-centric C2 design.

Overall, Rotexy is best characterized as an Android banking Trojan with SMS interception, device reconnaissance, and data exfiltration capabilities, augmented by blocker-style behavior associated with mobile ransomware tactics.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1546Event Triggered ExecutionEvidence1

A malicious application could create an application overlay window on top of a running legitimate application.

Privilege Escalation

1 technique

T1546Event Triggered ExecutionEvidence1

A malicious application could create an application overlay window on top of a running legitimate application.

Credential Access

2 techniques

T1056Input CaptureEvidence1

This study analyzes the banking malware that steals the credentials used to access online banking or payment system accounts and to intercept one-time passwords.

T1649Steal or Forge Authentication CertificatesEvidence1

This has been the dominant method in recent years... mimics the bank’s login page and reels in the victim’s credentials.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.

Collection

1 technique

T1056Input CaptureEvidence1

This study analyzes the banking malware that steals the credentials used to access online banking or payment system accounts and to intercept one-time passwords.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

DEFENSOR ID has used Firebase Cloud Messaging for C2; Rotexy can also communicate by using JSON messages sent through Google Cloud Messaging; Skygofree can be controlled via HTTP, XMPP, FirebaseCloudMessaging, or GoogleCloudMessaging in older versions.

T1071.001Web ProtocolsEvidence3

Gustuff gathers the device IMEI to send to the command and control server; Rotexy collects the device's IMEI and sends it to the command and control server; RuMMS gathers the device phone number and IMEI and transmits them to a command and control server.

T1071.005Publish/Subscribe ProtocolsEvidence1

DEFENSOR ID has used Firebase Cloud Messaging for C2. Rotexy can also communicate by using JSON messages sent through Google Cloud Messaging. Skygofree can be controlled via HTTP, XMPP, FirebaseCloudMessaging, or GoogleCloudMessaging in older versions. SpyC23 can communicate with the Command and Control server using HTTPS and Firebase Cloud Messaging (FCM). Trojan-SMS.AndroidOS.Agent.ao uses Google Cloud Messaging (GCM) for command and control. Trojan-SMS.AndroidOS.FakeInst.a uses Google Cloud Messaging (GCM) for command and control. Trojan-SMS.AndroidOS.OpFake.a uses Google Cloud Messaging (GCM) for command and control.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

Examples in the content include: 'Riltok can access and upload the device's contact list to the command and control server,' 'Rotexy can access and upload the contacts list to the command and control server,' and multiple entries stating malware can 'exfiltrate' contacts.

ACTIVITY FEED

Recent activity

19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

19 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Input Prompt, Technique T1411 - Mobile | MITRE ATT&CK®

Android malware described as a banker and ransomware that uses phishing overlays to steal credit card information.

mitre attack websiteNews

Oct 21, 2021

Capture SMS Messages, Technique T1412 - Mobile | MITRE ATT&CK®

Android banking trojan that filters, processes, and exfiltrates SMS messages, with emphasis on banks, payment systems, and mobile operators.

mitre attack websiteNews

Oct 21, 2021

Standard Application Layer Protocol, Technique T1437 - Mobile | MITRE ATT&CK®

Mobile banker with ransomware functionality that communicates with C2 via HTTP POST JSON payloads and Google Cloud Messaging.

mitre attack websiteNews

Oct 21, 2021

Application Discovery, Technique T1418 - Mobile | MITRE ATT&CK®

Mobile malware described as banker and ransomware that collects installed app lists and exfiltrates them to C2.

+15 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Rotexy