Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated mobile banking trojan, DoubleTrouble, has evolved in distribution methods and capabilities. Initially spread through phishing websites impersonating European banks, it now utilizes Discord channels for distribution. The malware employs advanced obfuscation techniques, abuses Android's Accessibility Services, and features screen capture, keylogging, and application blocking capabilities. It uses fake overlays to steal credentials and leverages sophisticated screen recording techniques. The trojan can block specific applications, implement a highly advanced keylogger, and execute a wide range of commands received from its Command and Control server. The malware's extensive functionalities enable credential theft, device manipulation, and persistent control over infected devices.

DoubleTrouble is a sophisticated Android mobile banking Trojan that has evolved both in its distribution methods and technical capabilities. Originally distributed through phishing websites impersonating European banks, it now also propagates via Discord channels, indicating a shift towards leveraging popular social platforms for malware dissemination. The Trojan employs advanced obfuscation techniques to evade detection by security solutions and abuses Android's Accessibility Services, a powerful feature that, when misused, grants the malware extensive control over the infected device. Its capabilities include screen capturing, keylogging, and application blocking, which facilitate the theft of banking credentials and other sensitive information. DoubleTrouble uses fake overlay screens to trick users into entering their credentials, and it employs sophisticated screen recording techniques to capture user interactions. The malware can block specific applications, preventing users from accessing legitimate banking apps or security tools, and it features a highly advanced keylogger to capture keystrokes stealthily. Additionally, it can execute a wide range of commands from its Command and Control (C2) server, enabling persistent control and manipulation of the infected device. These functionalities allow attackers to maintain long-term access, steal credentials, and manipulate device behavior to further their objectives. The absence of known exploits in the wild suggests it is either newly discovered or not yet widely deployed, but its advanced features and evolving distribution methods indicate a significant threat to mobile banking users, particularly in Europe where the initial phishing campaigns targeted local banks.

MD5 of 84faf02309080076fe526f8bc8c427fa6bb407c5da42c31866ba47c1478cbde9

MD5 of e3f84482977854a5c79d253f6dcca83b2911b8c1dc7cc76b533bdc7fc31255c9

MD5 of 91f5a4164bd557b34442550d204ad5e024dc02e2d5febf86699a7feae0a38480

MD5 of d002f0e354841d7090df5f20dd2b2b4c8b9d2216ce331690807bb58414390a29

MD5 of 64977c8e167609f52ebd89a4eda1a83282e3b9ea07115bf68acd7d9836e04a1b

MD5 of 2f9d70c75330b49a1a97479587d5e0b6016cf8004e454badf2b021e8bbb28469

MD5 of d45cb00646d1ead9b54810be048323179414097087ef873d0b86d8d9bcf77217

MD5 of b187a29d1e9e3e616f166d2fa3076bc22b9268d0b7b01b59ea8bd89f39a90010

MD5 of c247d9ec3fa20803ba769308c66d2b4c836ca0ac90f71d68a07f44d57eb8a501

MD5 of b9a13c4fe93d5b42dc38ae1c864d17388a32bcb89e7279f4bb649c92f67f1498

MD5 of 89060156441434da8f016bd872aeaa542d32820d49b3c00bce4426120110282e

MD5 of b7887187e30583b9e543af73640049f9e555a32a1691f6fde7b3a3ec7858dc7a

MD5 of 5a11f0cc9e3d8a080f6721964d3414ea638edc0fd4d22d3901f469feae4a8fa4

MD5 of fd558205fddb4c681c3799a28c97903ab19dfc96776df55d81edd835051523ed

MD5 of 05e00998bc5b18e3ac71987eeed9009ee8ba65de3f07ee90e761ace8c62878e1

MD5 of 7903328e73a07a9d27a4d0ea954bed96385f37bbd4d9afd81faec443588ca890

MD5 of e9c6cad185dac1513b7c0f62951a264165b75b40be61373c80835a9a10502579

MD5 of d181f30e0404c3ff85af22833600c3666c54cf904cc6387b926c9ad321c1206e

MD5 of 93601b436ccd7a7abde1546bd346fab820fe046164262c9105235e15f92a11e4

MD5 of b3d134eca184962eae23a8ade27b1faca5a48bd0211bc5a401ddecd045652cee

MD5 of 3e3a5d35eb5e11c3bfd63e75abd7f5022e8ee7288bc76a041354813f6ca601ce

SHA1 of b7887187e30583b9e543af73640049f9e555a32a1691f6fde7b3a3ec7858dc7a

SHA1 of b187a29d1e9e3e616f166d2fa3076bc22b9268d0b7b01b59ea8bd89f39a90010

SHA1 of 3e3a5d35eb5e11c3bfd63e75abd7f5022e8ee7288bc76a041354813f6ca601ce

SHA1 of c247d9ec3fa20803ba769308c66d2b4c836ca0ac90f71d68a07f44d57eb8a501

SHA1 of 89060156441434da8f016bd872aeaa542d32820d49b3c00bce4426120110282e

SHA1 of 7903328e73a07a9d27a4d0ea954bed96385f37bbd4d9afd81faec443588ca890

SHA1 of e3f84482977854a5c79d253f6dcca83b2911b8c1dc7cc76b533bdc7fc31255c9

SHA1 of d002f0e354841d7090df5f20dd2b2b4c8b9d2216ce331690807bb58414390a29

SHA1 of d45cb00646d1ead9b54810be048323179414097087ef873d0b86d8d9bcf77217

SHA1 of e9c6cad185dac1513b7c0f62951a264165b75b40be61373c80835a9a10502579

SHA1 of 5a11f0cc9e3d8a080f6721964d3414ea638edc0fd4d22d3901f469feae4a8fa4

SHA1 of 05e00998bc5b18e3ac71987eeed9009ee8ba65de3f07ee90e761ace8c62878e1

SHA1 of 91f5a4164bd557b34442550d204ad5e024dc02e2d5febf86699a7feae0a38480

SHA1 of 2f9d70c75330b49a1a97479587d5e0b6016cf8004e454badf2b021e8bbb28469

SHA1 of 93601b436ccd7a7abde1546bd346fab820fe046164262c9105235e15f92a11e4

SHA1 of 84faf02309080076fe526f8bc8c427fa6bb407c5da42c31866ba47c1478cbde9

SHA1 of 64977c8e167609f52ebd89a4eda1a83282e3b9ea07115bf68acd7d9836e04a1b

SHA1 of fd558205fddb4c681c3799a28c97903ab19dfc96776df55d81edd835051523ed

SHA1 of d181f30e0404c3ff85af22833600c3666c54cf904cc6387b926c9ad321c1206e

SHA1 of b9a13c4fe93d5b42dc38ae1c864d17388a32bcb89e7279f4bb649c92f67f1498

SHA1 of b3d134eca184962eae23a8ade27b1faca5a48bd0211bc5a401ddecd045652cee

CC=US ASN=AS8100 quadranet enterprises llc

Detailed information about Behind Random Words: DoubleTrouble Mobile Banking Trojan Revealed. Get real-time updates, technical details, and mitigation strategie

Threats Tagged 'doubletrouble'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'doubletrouble'

Lead Pen Test Professional