Android Marcher now posing as Super Mario Run
ID: 079fa3c7-a764-5994-98ce-cf920c555eaa
STIX ID: report--079fa3c7-a764-5994-98ce-cf920c555eaa
Feed Name: Zscaler Security Research Blog
Android Marcher banking malware is being distributed as a fake "Super Mario Run" Android app; upon installation it requests elevated permissions and displays fraudulent overlay pages (including fake banking and credit-card forms) to harvest credentials. The report includes indicators (package name uiq.pizfbwzbvxmtkmtbhnijdsrhdixqwd, MD5 d332560f1fc3e6dc58d94d6fa0dab748), a list of targeted banking apps, C&C details, observed obfuscation, and visible errors suggesting the variant may be under development.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
