Trusted Design

Tordow v2.0 Android Malware

概要

Tordow 2.0 can make telephone calls, control SMS messages, download and install programs, steal login credentials, access contacts, encrypt files, visit webpages, manipulate banking data, remove security software, reboot a device, rename files, and act as ransomware. It searches the Android and Google Chrome browsers for stored sensitive information. Technical details show that Tordow 2.0 also collects data about device hardware and software, operating system, manufacturer, Internet Service Provider, and user location.

Created: 2026-02-23

Indicators

類似Pulses

Ramdo Malware (Click-fraud) (score: 0.53)
Ratcheting Down on JSocket: A PC and Android Threat (score: 0.52)
Pushdo.s Malware Botnet (score: 0.51)
Google Security: Tizi Android Malware (score: 0.50)
New Family of Ransom Locker Found, Uses TOR Hidden Service (score: 0.49)

このPulseに関連する脅威アクター (事実ベース)

FIN6

Score: 10.39

Matched TTPs:

T1560.003 - Archive via Custom Method
T1036.004 - Masquerade Task or Service
T1569.002 - Service Execution
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

CopyKittens

Score: 3.15

Matched TTPs:

T1560.003 - Archive via Custom Method

MITREへのリンク →

Mustang Panda

Score: 13.18

Matched TTPs:

T1560.003 - Archive via Custom Method
T1588.003 - Code Signing Certificates
T1027.007 - Dynamic API Resolution
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Kimsuky

Score: 25.07

Matched TTPs:

T1560.003 - Archive via Custom Method
T1176.001 - Browser Extensions
T1036.004 - Masquerade Task or Service
T1218.010 - Regsvr32
T1598 - Phishing for Information
T1588.003 - Code Signing Certificates
T1102.001 - Dead Drop Resolver
T1078.003 - Local Accounts

MITREへのリンク →

UNC3886

Score: 5.25

Matched TTPs:

T1560.003 - Archive via Custom Method
T1036.004 - Masquerade Task or Service

MITREへのリンク →

Lotus Blossom

Score: 3.15

Matched TTPs:

T1560.003 - Archive via Custom Method

MITREへのリンク →

Lazarus Group

Score: 21.36

Matched TTPs:

T1560.003 - Archive via Custom Method
T1036.004 - Masquerade Task or Service
T1098 - Account Manipulation
T1189 - Drive-by Compromise
T1027.007 - Dynamic API Resolution
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
T1529 - System Shutdown/Reboot

MITREへのリンク →

Ember Bear

Score: 3.62

Matched TTPs:

T1114 - Email Collection

MITREへのリンク →

Silent Librarian

Score: 3.62

Matched TTPs:

T1114 - Email Collection

MITREへのリンク →

Magic Hound

Score: 11.10

Matched TTPs:

T1114 - Email Collection
T1087.003 - Email Account
T1036.004 - Masquerade Task or Service
T1189 - Drive-by Compromise

MITREへのリンク →

Scattered Spider

Score: 14.19

Matched TTPs:

T1114 - Email Collection
T1217 - Browser Information Discovery
T1098 - Account Manipulation
T1598 - Phishing for Information

MITREへのリンク →

TA505

Score: 3.62

Matched TTPs:

T1087.003 - Email Account

MITREへのリンク →

RedCurl

Score: 7.47

Matched TTPs:

T1087.003 - Email Account
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

Sandworm Team

Score: 3.62

Matched TTPs:

T1087.003 - Email Account

MITREへのリンク →

Fox Kitten

Score: 5.38

Matched TTPs:

T1217 - Browser Information Discovery
T1036.004 - Masquerade Task or Service

MITREへのリンク →

Volt Typhoon

Score: 7.42

Matched TTPs:

T1217 - Browser Information Discovery
T1614 - System Location Discovery

MITREへのリンク →

APT38

Score: 11.07

Matched TTPs:

T1217 - Browser Information Discovery
T1189 - Drive-by Compromise
T1569.002 - Service Execution
T1529 - System Shutdown/Reboot

MITREへのリンク →

Moonstone Sleet

Score: 9.12

Matched TTPs:

T1217 - Browser Information Discovery
T1598 - Phishing for Information
T1569.002 - Service Execution

MITREへのリンク →

Chimera

Score: 5.68

Matched TTPs:

T1217 - Browser Information Discovery
T1569.002 - Service Execution

MITREへのリンク →

FIN7

Score: 7.16

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1569.002 - Service Execution
T1078.003 - Local Accounts

MITREへのリンク →

APT32

Score: 14.42

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1218.010 - Regsvr32
T1189 - Drive-by Compromise
T1569.002 - Service Execution
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
T1078.003 - Local Accounts

MITREへのリンク →

Winter Vivern

Score: 3.86

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1189 - Drive-by Compromise

MITREへのリンク →

Wizard Spider

Score: 14.01

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1555.004 - Windows Credential Manager
T1588.003 - Code Signing Certificates
T1569.002 - Service Execution
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

PROMETHIUM

Score: 6.53

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1189 - Drive-by Compromise
T1078.003 - Local Accounts

MITREへのリンク →

ZIRCONIUM

Score: 5.53

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1598 - Phishing for Information

MITREへのリンク →

Higaisa

Score: 5.25

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1027.015 - Compression

MITREへのリンク →

Storm-0501

Score: 8.69

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1218.010 - Regsvr32
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

APT41

Score: 7.78

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1569.002 - Service Execution
T1102.001 - Dead Drop Resolver

MITREへのリンク →

HAFNIUM

Score: 10.64

Matched TTPs:

T1098 - Account Manipulation
T1550.001 - Application Access Token
T1078.003 - Local Accounts

MITREへのリンク →

Gamaredon Group

Score: 7.69

Matched TTPs:

T1001 - Data Obfuscation
T1027.015 - Compression

MITREへのリンク →

Blue Mockingbird

Score: 5.14

Matched TTPs:

T1218.010 - Regsvr32
T1569.002 - Service Execution

MITREへのリンク →

Leviathan

Score: 7.66

Matched TTPs:

T1218.010 - Regsvr32
T1189 - Drive-by Compromise
T1027.015 - Compression

MITREへのリンク →

APT19

Score: 4.51

Matched TTPs:

T1218.010 - Regsvr32
T1189 - Drive-by Compromise

MITREへのリンク →

OilRig

Score: 14.06

Matched TTPs:

T1137.004 - Outlook Home Page
T1555.004 - Windows Credential Manager
T1588.003 - Code Signing Certificates
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

SideCopy

Score: 4.13

Matched TTPs:

T1614 - System Location Discovery

MITREへのリンク →

APT28

Score: 18.01

Matched TTPs:

T1598 - Phishing for Information
T1189 - Drive-by Compromise
T1550.001 - Application Access Token
T1669 - Wi-Fi Networks
T1211 - Exploitation for Defense Evasion

MITREへのリンク →

Stealth Falcon

Score: 3.62

Matched TTPs:

T1555.004 - Windows Credential Manager

MITREへのリンク →

Turla

Score: 8.05

Matched TTPs:

T1555.004 - Windows Credential Manager
T1189 - Drive-by Compromise
T1078.003 - Local Accounts

MITREへのリンク →

DarkVishnya

Score: 4.54

Matched TTPs:

T1200 - Hardware Additions

MITREへのリンク →

INC Ransom

Score: 6.24

Matched TTPs:

T1537 - Transfer Data to Cloud Account
T1569.002 - Service Execution

MITREへのリンク →

RTM

Score: 5.05

Matched TTPs:

T1189 - Drive-by Compromise
T1102.001 - Dead Drop Resolver

MITREへのリンク →

Patchwork

Score: 5.05

Matched TTPs:

T1189 - Drive-by Compromise
T1102.001 - Dead Drop Resolver

MITREへのリンク →

BRONZE BUTLER

Score: 5.05

Matched TTPs:

T1189 - Drive-by Compromise
T1102.001 - Dead Drop Resolver

MITREへのリンク →

Threat Group-3390

Score: 8.07

Matched TTPs:

T1189 - Drive-by Compromise
T1588.003 - Code Signing Certificates
T1027.015 - Compression

MITREへのリンク →

Mustard Tempest

Score: 6.30

Matched TTPs:

T1189 - Drive-by Compromise
T1608.006 - SEO Poisoning

MITREへのリンク →

APT37

Score: 5.39

Matched TTPs:

T1189 - Drive-by Compromise
T1529 - System Shutdown/Reboot

MITREへのリンク →

Contagious Interview

Score: 7.28

Matched TTPs:

T1547.013 - XDG Autostart Entries
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

BlackTech

Score: 3.15

Matched TTPs:

T1588.003 - Code Signing Certificates

MITREへのリンク →

FIN8

Score: 5.90

Matched TTPs:

T1588.003 - Code Signing Certificates
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Velvet Ant

Score: 9.20

Matched TTPs:

T1569.002 - Service Execution
T1078.003 - Local Accounts
T1211 - Exploitation for Defense Evasion

MITREへのリンク →

Medusa Group

Score: 10.56

Matched TTPs:

T1569.002 - Service Execution
T1529 - System Shutdown/Reboot
T1218.014 - MMC

MITREへのリンク →

Rocke

Score: 3.29

Matched TTPs:

T1102.001 - Dead Drop Resolver

MITREへのリンク →

Molerats

Score: 3.15

Matched TTPs:

T1027.015 - Compression

MITREへのリンク →

TA2541

Score: 3.15

Matched TTPs:

T1027.015 - Compression

MITREへのリンク →

Mofang

Score: 3.15

Matched TTPs:

T1027.015 - Compression

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.77

Matched TTPs:

T1176.001 - Browser Extensions
T1588.003 - Code Signing Certificates
T1102.001 - Dead Drop Resolver
T1598 - Phishing for Information
T1078.003 - Local Accounts
T1560.003 - Archive via Custom Method
T1218.010 - Regsvr32
T1036.004 - Masquerade Task or Service

MITREへのリンク →

Lazarus Group

Score: 0.66

Matched TTPs:

T1027.007 - Dynamic API Resolution
T1529 - System Shutdown/Reboot
T1189 - Drive-by Compromise
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
T1560.003 - Archive via Custom Method
T1036.004 - Masquerade Task or Service
T1098 - Account Manipulation

MITREへのリンク →

APT28

Score: 0.57

Matched TTPs:

T1550.001 - Application Access Token
T1189 - Drive-by Compromise
T1669 - Wi-Fi Networks
T1211 - Exploitation for Defense Evasion
T1598 - Phishing for Information

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る