BeatBanker
BeatBanker is an Android malware family/campaign targeting users in Brazil. It is distributed primarily through phishing pages and bogus websites masquerading as the Google Play Store, including lures posing as Brazilian government apps such as “INSS Reembolso” and as a fake Starlink app. Kaspersky identified it as a new Android Trojan that combines banking-trojan behavior with cryptocurrency mining, specifically Monero mining via a modified XMRig 6.17.0 component compiled for ARM devices.
The malware uses a staged installation flow to obtain permissions and deliver additional encrypted modules. Reported behavior includes anti-analysis and environment checks to verify it is running on a real device and in the target country, in-memory decryption/loading of hidden DEX code, and a fake Play Store update screen used to prompt installation of further payloads. BeatBanker establishes persistence by running a foreground service that continuously plays an almost inaudible 5-second MP3 containing Chinese speech, and it may also display a persistent system-update style notification. It uses Google Firebase Cloud Messaging (FCM) for command-and-control and telemetry, including battery level, temperature, charging state, user activity, and overheating status, allowing operators to start or stop mining to reduce visibility.
Financially motivated capabilities described in the reporting include theft of banking data, credential theft, monitoring of browser activity and visited URLs, interception of one-time codes from Google Authenticator, clipboard monitoring, keystroke interception, SMS sending, audio recording, screen streaming/recording, and simulated taps/text input. BeatBanker also creates overlays for Binance and Trust Wallet and can replace destination addresses during USDT transactions, effectively tampering with cryptocurrency transfers. Earlier reporting describes it as targeting Brazilian banks and PIX-related payment infrastructure more broadly.
Recent BeatBanker variants reportedly replaced the banking module with BTMOB RAT instead of the original banking component. In those variants, BTMOB provides broader remote-access and surveillance functionality, including persistent access, full device control, keylogging, credential capture, screen recording, camera access, and GPS tracking.
High-confidence infrastructure and indicators directly mentioned in the content include the phishing domain cupomgratisfood[.]shop; mining-related domains/access points accessor.fud2026.com, fud2026.com, pool.fud2026[.]com:9000, and pool-proxy.fud2026[.]com:9000; the persistence audio file output8.mp3; and targeted package/application names including Binance, Trust Wallet, and the lure apps “INSS Reembolso” and fake Starlink installers.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
3 techniques
Persistence
"keeps a notification... pinned to the foreground and activates a foreground service" | "plays an almost inaudible audio file on a loop so it cannot be terminated"
Privilege Escalation
4 techniques
Privilege Escalation
"the fake update downloader injects modules directly into RAM to avoid creating files"
"keeps a notification... pinned to the foreground and activates a foreground service" | "plays an almost inaudible audio file on a loop so it cannot be terminated"
Stealth
6 techniques
Stealth
BeatBanker targeting Brazil, posing as government apps and Google Play Store
"the fake update downloader injects modules directly into RAM to avoid creating files"
"Besides incorporating runtime checks for emulated or analysis environments"; "advanced evasion techniques, such as native library encryption, rolling XOR string obfuscation"
Credential Access
3 techniques
Credential Access
Discovery
3 techniques
Discovery
"...sends... information about the device’s battery level and temperature, charging status, usage activity, and whether it has overheated."
Collection
4 techniques
Collection
Command and Control
3 techniques
Command and Control
"Using Firebase Cloud Messaging (FCM), the malware continuously sends the command-and-control (C2) server information about the device’s battery level and temperature..."
IOCs tracked for this family
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as one of 17 Android malware families detected in the wild over four months.
Android malware/tooling referenced as using Firebase for C2 and Monero mining while targeting Brazilian PIX payment infrastructure.
Android malware targeting Brazilian users; spreads via phishing/fake Play Store pages, uses an unusual audio-loop persistence trick, includes a banking trojan component with crypto transaction overlays (e.g., Binance/Trust Wallet) and a Monero miner; uses FCM for C2 and supports extensive remote commands.
Android malware distributed as a fake Starlink app via bogus Play Store sites. Performs anti-analysis checks, shows a fake Play Store update screen to enable additional payload delivery, establishes persistence (via playing a low-audible MP3), and deploys a banking trojan module and a cryptominer. Newer versions reportedly replace the banking module with a RAT for full device compromise (screen recording, credential theft, keylogging, camera/GPS access).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.