TLP:WHITE46 IOCs

Take my money: OCR crypto stealers in Google Play and App Store

Botvrij.eu OSINT Feed

Published February 8, 2025Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(1)

Infrastructure(6)

Capability(1)

Victim

5W+H Threat Analysis

Analysis unavailable

Indicators of Compromise

Indicators of Compromise46

Type	Indicator	Confidence	Score	First Seen
MD5	6a9c0474cc5e0b8a9b1e3baed5a26893 file-hashloadermalware	High	68	Jun 2, 26
MD5	bbcbf5f3119648466c1300c3c51a1c77 file-hashloadermalware	High	68	Jun 2, 26
Domain	com.bintiger.mall.android malwarenetwork	High	68	Jun 2, 26
Domain	api.aliyung.com malwarenetwork	High	68	Jun 2, 26
MD5	54ac7ae8ace37904dcd61f74a7ff0d42 file-hashloadermalware	High	68	Jun 2, 26
MD5	00ed27c35b2c53d853fafe71e63339ed file-hashloadermalware	High	68	Jun 2, 26
Domain	im.token.app malwarenetwork	High	68	Jun 2, 26
MD5	db128221836b9c0175a249c7f567f620 file-hashloadermalware	High	68	Jun 2, 26
Domain	com.mjb.worldminer.new malwarenetwork	High	68	Jun 2, 26
MD5	a8cd933b1cb4a6cae3f486303b8ab20a file-hashloadermalware	High	68	Jun 2, 26
MD5	21bf5e05e53c0904b577b9d00588e0e7 file-hashloadermalware	High	68	Jun 2, 26
MD5	ee714946a8af117338b08550febcd0a9 file-hashloadermalware	High	68	Jun 2, 26
MD5	02646d3192e3826dd3a71be43d8d2a9e file-hashloadermalware	High	68	Jun 2, 26
Domain	com.yz.eternal.new malwarenetwork	High	68	Jun 2, 26
MD5	6a49749e64eb735be32544eab5a6452d file-hashloadermalware	High	68	Jun 2, 26
MD5	10c9dcabf0a7ed8b8404cd6b56012ae4 file-hashloadermalware	High	68	Jun 2, 26
MD5	66b819e02776cb0b0f668d8f4f9a71fd file-hashloadermalware	High	68	Jun 2, 26
MD5	51cb671292eeea2cb2a9cc35f2913aa3 file-hashloadermalware	High	68	Jun 2, 26
MD5	7ac98ca66ed2f131049a41f4447702cd file-hashloadermalware	High	68	Jun 2, 26
Domain	api.aliyung.org malwarenetwork	High	68	Jun 2, 26
MD5	f28f4fd4a72f7aab8430f8bc91e8acba file-hashloadermalware	High	68	Jun 2, 26
Domain	org.safew.messenger.store malwarenetwork	High	68	Jun 2, 26
MD5	cd6b80de848893722fa11133cbacd052 file-hashloadermalware	High	68	Jun 2, 26
MD5	31ebf99e55617a6ca5ab8e77dfd75456 file-hashloadermalware	High	68	Jun 2, 26
Domain	com.feidu.pay malwarenetwork	High	68	Jun 2, 26
MD5	caf92da1d0ff6f8251991d38a840fb4a file-hashloadermalware	High	68	Jun 2, 26
MD5	fe175909ac6f3c1cce3bc8161808d8b7 file-hashloadermalware	High	68	Jun 2, 26
MD5	a4a6d233c677deb862d284e1453eeafb file-hashloadermalware	High	68	Jun 2, 26
MD5	24db4778e905f12f011d13c7fb6cebde file-hashloadermalware	High	68	Jun 2, 26
Domain	api.googleapps.top malwarenetworkrat	High	68	Jun 2, 26
MD5	1e14de6de709e4bf0e954100f8b4796b file-hashloadermalware	High	68	Jun 2, 26
Domain	uploads.99ai.world malwarenetwork	High	68	Jun 2, 26
MD5	0ff6a5a204c60ae5e2c919ac39898d4f file-hashloadermalware	High	68	Jun 2, 26
Domain	com.atvnewsonline.app malwarenetworkproxy	High	68	Jun 2, 26
Domain	com.ai.sport malwarenetworkproxy	High	68	Jun 2, 26
MD5	4ee16c54b6c4299a5dfbc8cf91913ea3 file-hashloadermalware	High	68	Jun 2, 26
Domain	socket.99ai.world malwarenetworkrat	High	68	Jun 2, 26
Domain	com.websea.exchange malwarenetworkproxy	High	68	Jun 2, 26
MD5	0b4ae281936676451407959ec1745d93 file-hashloadermalware	High	68	Jun 2, 26
Domain	api.firebaseo.com malwarenetwork	High	68	Jun 2, 26
MD5	f99252b23f42b9b054b7233930532fcd file-hashloadermalware	High	68	Jun 2, 26
MD5	35fce37ae2b84a69ceb7bbd51163ca8a file-hashloadermalware	High	68	Jun 2, 26
Domain	xyz.starohm.chat malwarenetwork	High	68	Jun 2, 26
MD5	eea5800f12dd841b73e92d15e48b2b71 file-hashloadermalware	High	68	Jun 2, 26
Domain	com.wetink.chat malwarenetworkproxy	High	68	Jun 2, 26
Domain	com.llyy.au malwarenetworkproxy	High	68	Jun 2, 26

IOC Relationship Graph

IOC Relationship Graph46 total IOCs

MD5Domain

scroll to zoom · drag to pan · click IOC to open