Malbus

High-level Description

• Year: 2019
• Blog: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/malbus-popular-south-korean-bus-app-series-in-google-play-found-dropping-malware-after-5-years-of-development/

This malware application aims to steal social accounts form the user. The sample retrieves commands and an executable from the malware developers server. The payload executes phishing forms to steal social accounts from the user (an observed behavior, as the server to download the executable was down).

Signature

The image of the signature can be downloaded here for closer inspection.