Banking Trojan Targets Banking Users in Malaysia

This report analyzes an Android banking Trojan that impersonates a Malaysian cleaning-service app and website to steal SMS messages and internet-banking credentials; it includes technical artifacts (package name, SHA256), manifest/permission abuse (RECEIVE_SMS), source/traffic observations showing SMS and credential exfiltration to C2 domains, hosted phishing pages for multiple Malaysian banks, MITRE ATT&CK mappings, and IOCs (malicious APK hash and C2 URLs).