TF-MAL-apk.mandrake
📛 Threat Title
Malware family: Mandrake
Description
ThreatFox malware family `apk.mandrake`. Printable name: Mandrake.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.mandrake
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.mandrake
IOC database
- Type
- domain
- Value
apk.mandrake- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.mandrake
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.mandrake
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:arstechnica.com
Mysterious family of malware hid in Google Play for years Mandrake's ability to go unnoticed was the result of designs not often seen in Android malware .
-
web:attack.mitre.org
Mandrake has gone undetected for several years by providing legitimate, ad-free applications with social media and real reviews to back the apps. The malware is only activated when the operators issue a specific command.
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:medium.com
The Mandrake family of malware targeting Android devices has its newest generation carrying on its tradition of using complex methods to evade detection.
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.fortinet.com
FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.
-
web:www.pcrisk.com
What kind of malware is Mandrake ? Mandrake is a spyware targeting Android devices. Malicious software within this classification is designed to steal and record victims' information. One of the primary goals of Mandrake is to acquire log-in credentials. This malware has been around since at least 2016. Multiple variants of Mandrake have emerged throughout the years, yet the program's main ...
-
web:www.researchgate.net
Prevention and detection of eBPF-based malware is also explored, with the goal of providing organizations or legitimate users of eBPF techniques to harden their systems against eBPF-based malware ...
-
web:www.tomsguide.com
Hackers used malware droppers to spread the Mandrake Android spyware via the Google Play Store for years.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.