TF-MAL-apk.pixstealer
📛 Threat Title
Malware family: PixStealer
Description
ThreatFox malware family `apk.pixstealer`. Printable name: PixStealer. Aliases: BrazKing.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.pixstealer
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.pixstealer
IOC database
- Type
- domain
- Value
apk.pixstealer- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.pixstealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.pixstealer
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family . The page below gives you an overview on malware samples that MalwareBazaar has identified as PixStealer .
-
web:en.iguru.gr
Check Point Research (CPR) has detected cyberattacks against users of PIX, the instant payment solution developed and managed by the Central Bank of Brazil. The attackers distributed two different variants of banking malware , called PixStealer and MalRhino, through two different malicious applications in the Google Play Store to carry out their attacks. Both malicious applications were ...
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the PixStealer malware family including references, samples and yara signatures.
-
web:malware.news
Check Point Research (CPR) recently discovered a new wave of malicious Android applications targeting PIX and Brazilian bank applications. These malicious applications are an evolution of a known family of Brazilian banking malware and were once distributed on Google Store. Security researchers analyzed the malicious applications back in April 2021 and found an extension to new techniques and ...
-
web:research.checkpoint.com
Figure 2: The PixStealer malware asking for access to the Android Accessibility Service. Similar to the previous versions of the malware , the service is named com.gservice.autobot.Acessibilidade. After receiving the Accessibility Service permission, the malware shows a text message with a call to open the PagBank application for synchronization.
-
web:secartifacts.github.io
The malware APK already contains C&C-loaded payloads that DVa's dynamic hooking frame-work extracted when the servers were live. Running DVa against Pixstealer covers all three major mal-ware analysis tasks claimed in the paper, namely detecting a11y malware's targeting victims, abuse vectors, and persis-tence mechanisms.
-
web:sechub.in
With this approach, the malware cannot update itself by communicating with a C&C, or steal and upload any information about the victims, but achieves the very important goal: to stay undetectable. Figure 1: Virus Total detections of the PixStealer sample.
-
web:thehackernews.com
Six Android malware families discovered targeting banking apps and crypto wallets, exploiting accessibility features to steal funds and data.
-
web:www.usenix.org
The malware APK already contains C&C-loaded payloads that DVa's dynamic hooking frame-work extracted when the servers were live. Running DVa against Pixstealer covers all three major mal-ware analysis tasks claimed in the paper, namely detecting a11y malware's targeting victims, abuse vectors, and persis-tence mechanisms.
-
web:www.youtube.com
SHA256: 1a10e9cc3c8f6e3c6dd8f8220c9bbd3183b71cd59a8e3736073a3128fe97cc88
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.