Malware

SimBad

SimBad is an Android malware family embedded into otherwise legitimate applications as a trojanized component. It is associated with deceptive app repackaging and masquerading techniques to gain installation on victim devices. Once present, SimBad uses Android broadcast receivers for event-triggered execution, specifically registering for device boot and user-presence events so it can automatically perform actions after reboot and when the device is actively in use. This behavior supports persistence and ongoing background operation on infected devices. SimBad is also capable of installing attacker-specified applications, indicating use as a secondary-stage delivery mechanism for additional malicious payloads. The malware targets Android devices and is notable for combining trojanized-app distribution with persistent event-driven execution and follow-on app installation.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence1

Bouncing Golf distributed malware as repackaged legitimate applications, with the malicious code in the com.golf package.

Persistence

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

EventBot registers for the BOOT_COMPLETED intent to auto-start after the device boots. Pegasus for Android listens for the BOOT_COMPLETED broadcast intent in order to maintain persistence and activate its functionality at device boot time.

Privilege Escalation

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Some Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Broadcast Receivers, Technique T1402 - Mobile | MITRE ATT&CK®

Rogue Android adware that uses broadcast intents to trigger actions after boot and during user activity.

mitre attack websiteNews

Oct 21, 2021

Masquerade as Legitimate Application, Technique T1444 - Mobile | MITRE ATT&CK®

Android adware embedded into legitimate applications.

mitre attack websiteNews

Jul 8, 2020

Masquerade as Legitimate Application, Technique T1444 - Mobile | MITRE ATT&CK®

Rogue adware campaign embedded into legitimate Android applications.

mitre attack websiteNews

Jul 8, 2020

Deliver Malicious App via Other Means, Technique T1476 - Mobile | MITRE ATT&CK®

Rogue adware campaign capable of installing attacker-specified applications.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SimBad