Banking Trojan Variant Spreading Through Android App

Cyble researchers analyzed an Android banking Trojan distributed via a fake app (package com.android.ktspo, main activity pkgflag.cocknut.yummy.MainActivity) that targets users in Korea; the malware requests extensive permissions, implements SMS capture, keylogging, audio recording, location tracking, call monitoring, process termination, and exfiltrates collected data to a Command-and-Control URL (http://103.147.12.89/api/interfaceA). The report provides static and dynamic findings, a SHA256 sample hash, IoCs, a mapping to MITRE ATT&CK mobile techniques, and actionable safety recommendations for users and organizations.