Malware

BasBanke

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

To trick users into downloading the malware, the authors advertise it via Facebook and WhatsApp messages. Campaign’s new URLs redirect victims either to the official Google Play Store or to a website hosting malicious APK packages.

Stealth

1 technique

T1036MasqueradingEvidence1

The malicious applications hosted in Google Play Store disguise themselves as applications with supposed functionality such as a secure QR reader, a fake app for a real travel agency with travel deals, and – implementing a well-known trick – as an application to “see who visited your profile.”

Credential Access

1 technique

T1056.001KeyloggingEvidence1

This malware can perform tasks such as keystroke logging, screen recording, SMS interception, and the theft of credit card and financial information.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

metadata such as the device name, IMEI, and the telephone number used by the victim are sent to a remote C2.

Collection

2 techniques

T1056.001KeyloggingEvidence1

This malware can perform tasks such as keystroke logging, screen recording, SMS interception, and the theft of credit card and financial information.

T1113Screen CaptureEvidence1

This malware can perform tasks such as keystroke logging, screen recording, SMS interception, and the theft of credit card and financial information.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

metadata such as the device name, IMEI, and the telephone number used by the victim are sent to a remote C2.

INDICATORS OF COMPROMISE

IOCs tracked for this family

25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

15 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

securelistNews

May 13, 2021

BasBanke: Trend-setting Brazilian banking Trojan | Securelist

Android banking trojan targeting Brazilian users that steals banking credentials, credit/debit card data, device metadata, intercepts SMS, performs keylogging and screen recording, and exfiltrates data to a remote C2. It was distributed via malicious apps on Google Play and promoted through Facebook and WhatsApp.

securelistNews

May 13, 2021

Ghimob: a Tétrade threat actor moves to infect mobile devices | Securelist

A Brazilian mobile banking trojan family mentioned only as a comparison point to Ghimob's capabilities and international ambitions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching25

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

BasBanke

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Stealth

1 technique

T1036MasqueradingEvidence1

Credential Access

1 technique

T1056.001KeyloggingEvidence1

This malware can perform tasks such as keystroke logging, screen recording, SMS interception, and the theft of credit card and financial information.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

metadata such as the device name, IMEI, and the telephone number used by the victim are sent to a remote C2.

Collection

2 techniques

T1056.001KeyloggingEvidence1

This malware can perform tasks such as keystroke logging, screen recording, SMS interception, and the theft of credit card and financial information.

T1113Screen CaptureEvidence1

This malware can perform tasks such as keystroke logging, screen recording, SMS interception, and the theft of credit card and financial information.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

metadata such as the device name, IMEI, and the telephone number used by the victim are sent to a remote C2.

INDICATORS OF COMPROMISE

IOCs tracked for this family

25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

15 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

securelistNews

May 13, 2021

BasBanke: Trend-setting Brazilian banking Trojan | Securelist

securelistNews

May 13, 2021

Ghimob: a Tétrade threat actor moves to infect mobile devices | Securelist

A Brazilian mobile banking trojan family mentioned only as a comparison point to Ghimob's capabilities and international ambitions.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching25

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.