- S0288 KeyRaider — malware.
Most KeyRaider samples search to find the Apple account's username, password and device's GUID in data being transferred.[Xiao-KeyRaider]
Exact relationship: relationship--05563777-5771-4bd6-a1af-3e244cf42372 - S0289 Pegasus for iOS — malware.
Pegasus for iOS monitors the victim for status and disables other access to the phone by other jailbreaking software.[Lookout-Pegasus]
Exact relationship: relationship--7af7d094-3a49-4e5e-99d0-385c79f95f06 - S0304 Android/Chuli.A — malware.
Android/Chuli.A gathered system information including phone number, OS version, phone model, and SDK version.[Kaspersky-WUC]
Exact relationship: relationship--83991b5c-59b9-4fe5-9ef2-39c6ddc8b835 - S0310 ANDROIDOS_ANSERVER.A — malware.
ANDROIDOS_ANSERVER.A gathers the device OS version, device build version, manufacturer, and model.[TrendMicro-Anserver2]
Exact relationship: relationship--a82d3cfb-7ef2-4e39-a6e1-3097d7b106f7 - S0311 YiSpecter — malware.
YiSpecter has collected the device UUID.[paloalto_yispecter_1015]
Exact relationship: relationship--fc7639c8-0e52-4f6f-9cf3-7840be81ad55 - S0313 RuMMS — malware.
RuMMS gathers device model and operating system version information and transmits it to a command and control server.[FireEye-RuMMS]
Exact relationship: relationship--bb3be217-08e2-4bb0-9f1a-d8e538010451 - S0318 XLoader for Android — malware.
XLoader for Android collects the device’s Android ID and serial number.[TrendMicro-XLoader-FakeSpy]
Exact relationship: relationship--020f79c6-d5f8-49eb-beee-e716e1fa4e80 - S0326 RedDrop — malware.
RedDrop exfiltrates details of the victim device operating system and manufacturer.[Wandera-RedDrop]
Exact relationship: relationship--e9cbc901-38cb-4895-9dfb-7a4fe10ba6d7 - S0399 Pallas — malware.
Pallas queries the device for metadata, such as device ID, OS version, and the number of cameras.[Lookout Dark Caracal Jan 2018]
Exact relationship: relationship--9366529d-fba9-4ef6-b4ee-b6b41aa3b18c - S0403 Riltok — malware.
Riltok can query various details about the device, including phone number, country, mobile operator, model, root availability, and operating system version.[Kaspersky Riltok June 2019]
Exact relationship: relationship--7b8c3ae2-7e52-4f1d-ad30-788b367a7531 - S0406 Gustuff — malware.
Gustuff gathers information about the device, including the default SMS application, if SafetyNet is enabled, the battery level, the operating system version, and if the malware has elevated permissions.[Talos Gustuff Apr 2019]
Exact relationship: relationship--a87fa426-3968-4d3b-8f8d-8e3c3a9c32f5 - S0407 Monokle — malware.
Monokle queries the device for metadata such as make, model, and power levels.[Lookout-Monokle]
Exact relationship: relationship--be256f8a-8bae-4a00-8682-22797ba7e0ce - S0411 Rotexy — malware.
Rotexy collects information about the compromised device, including phone number, network operator, OS version, device model, and the device registration country.[securelist rotexy 2018]
Exact relationship: relationship--ee9c1a8c-5f84-4571-8518-300a6412df0f - S0418 ViceLeaker — malware.
ViceLeaker collects device information, including the device model and OS version.[SecureList - ViceLeaker 2019]
Exact relationship: relationship--271a311f-71bc-4558-a314-0edfbec44b64 - S0420 Dvmap — malware.
Dvmap checks the Android version to determine which system library to patch.[SecureList DVMap June 2017]
Exact relationship: relationship--70ec9e67-b755-41ee-a1db-71d250a90b4e - S0421 GolfSpy — malware.
GolfSpy can obtain the device’s battery level, network operator, connection information, sensor information, and information about the device’s storage and memory.[Trend Micro Bouncing Golf 2019]
Exact relationship: relationship--ccfffa97-17fd-4826-9a16-c9d8174fb8ac - S0422 Anubis — malware.
Anubis can collect the device’s ID.[Cofense Anubis]
Exact relationship: relationship--50ad2a8c-ed45-4376-be31-8bafa26ba794 - S0425 Corona Updates — malware.
Corona Updates can collect various pieces of device information, including OS version, phone model, and manufacturer.[TrendMicro Coronavirus Updates]
Exact relationship: relationship--b018fe06-740b-4864-b30a-f047598506b3 - S0427 TrickMo — malware.
TrickMo can collect device information such as network operator, model, brand, and OS version.[SecurityIntelligence TrickMo]
Exact relationship: relationship--950e1476-83ca-4e81-b542-c91a19b206d7 - S0463 INSOMNIA — malware.
INSOMNIA can collect the device’s name, serial number, iOS version, total disk space, and free disk space.[Google Project Zero Insomnia]
Exact relationship: relationship--0993769f-63fb-4720-bbcf-e6f37f71515e - S0478 EventBot — malware.
EventBot can collect system information such as OS version, device vendor, and the type of screen lock that is active on the device.[Cybereason EventBot]
Exact relationship: relationship--92c9106d-a71b-4a4f-a9d4-ef692a0294eb - S0480 Cerberus — malware.
Cerberus can collect device information, such as the default SMS app and device locale.[Threat Fabric Cerberus][CheckPoint Cerberus]
Exact relationship: relationship--ad0c873b-9e45-44e0-adaf-529921ee7a77 - S0485 Mandrake — malware.
Mandrake can access device configuration information and status, including Android version, battery level, device model, country, and SIM operator.[Bitdefender Mandrake]
Exact relationship: relationship--eceeb39e-887c-4a9b-a93b-a6fd768e455a - S0490 XLoader for iOS — malware.
XLoader for iOS can obtain the device’s UDID, version number, and product number.[TrendMicro-XLoader-FakeSpy]
Exact relationship: relationship--3f392718-87c4-483b-b89f-4f0cc056d251 - S0505 Desert Scorpion — malware.
Desert Scorpion can collect device metadata and can check if the device is rooted.[Lookout Desert Scorpion]
Exact relationship: relationship--6de29595-e63e-4d7e-992f-b4622b7b8e23 - S0506 ViperRAT — malware.
ViperRAT can collect system information, including brand, manufacturer, and serial number.[Lookout ViperRAT]
Exact relationship: relationship--6c859d6b-28b1-409d-90ea-d4eba64edf82 - S0507 eSurv — malware.
eSurv’s iOS version can collect device information.[Lookout eSurv]
Exact relationship: relationship--4df6a22e-489f-400c-b953-cc53bfb708a3 - S0509 FakeSpy — malware.
FakeSpy can collect device information, including OS version and device model.[Cybereason FakeSpy]
Exact relationship: relationship--873b98de-d7cf-471b-9aa2-229eb03c9165 - S0522 Exobot — malware.
Exobot can obtain the device’s country and carrier name.[Threat Fabric Exobot]
Exact relationship: relationship--da424f3f-8a93-4a66-858c-b33f587108e6 - S0525 Android/AdDisplay.Ashas — malware.
Android/AdDisplay.Ashas can collect information about the device including device type, OS version, language, free storage space, battery status, device root, and if *developer mode* is enabled.[WeLiveSecurity AdDisplayAshas]
Exact relationship: relationship--1c180c0e-c789-4176-b568-789ada9487bb - S0529 CarbonSteal — malware.
CarbonSteal has gathered device metadata, including model, manufacturer, SD card size, disk usage, memory, CPU, and serial number.[Lookout Uyghur Campaign]
Exact relationship: relationship--760faa7b-06cb-48b7-9103-1c52f2ca408f - S0535 Golden Cup — malware.
Golden Cup can collect various pieces of device information, such as serial number and product information.[Symantec GoldenCup]
Exact relationship: relationship--07036963-6f5e-4eb5-9b20-3f81dd582c85 - S0536 GPlayed — malware.
GPlayed can collect the device’s model, country, and Android version.[Talos GPlayed]
Exact relationship: relationship--bbe1af69-7303-4205-82d8-5b03c43e39c1 - S0540 Asacub — malware.
Asacub can collect various pieces of device information, including device model and OS version.[Securelist Asacub]
Exact relationship: relationship--496976ef-4a0c-4782-95e7-231bd44df162 - S0544 HenBox — malware.
HenBox can collect device information and can check if the device is running MIUI on a Xiaomi device.[Palo Alto HenBox]
Exact relationship: relationship--9c853c22-7607-4cbd-b114-08aaa4625c35 - S0550 DoubleAgent — malware.
DoubleAgent has accessed common system information.[Lookout Uyghur Campaign]
Exact relationship: relationship--f9de9819-b131-459e-948b-bdf3fe6f1ef0 - S0551 GoldenEagle — malware.
GoldenEagle has checked for system root.[Lookout Uyghur Campaign]
Exact relationship: relationship--b9b9ce86-89f6-41ea-8ba1-9520985acb49 - S0555 CHEMISTGAMES — malware.
CHEMISTGAMES has fingerprinted devices to uniquely identify them.[CYBERWARCON CHEMISTGAMES]
Exact relationship: relationship--0b693e45-cc20-45a9-846f-2f5f4d3a3253 - S0558 Tiktok Pro — malware.
Tiktok Pro can check the device’s battery status.[Zscaler TikTok Spyware]
Exact relationship: relationship--8c8ce536-d9b5-4dfc-93f1-84c4f222b49e - S0577 FrozenCell — malware.
FrozenCell has gathered the device manufacturer, model, and serial number.[Lookout FrozenCell]
Exact relationship: relationship--c264d954-8b5f-4be1-acf0-6387b7f04fae - S1056 TianySpy — malware.
TianySpy can gather device UDIDs.[trendmicro_tianyspy_0122]
Exact relationship: relationship--4a408dee-07da-4855-b2ff-be512480ccb5 - S1061 AbstractEmu — malware.
AbstractEmu can collect device information such as manufacturer, model, version, serial number, and telephone number.[lookout_abstractemu_1021]
Exact relationship: relationship--a46c3b05-07d5-461c-b1b1-4a81912b79f8 - S1062 S.O.V.A. — malware.
S.O.V.A. can gather data about the device.[threatfabric_sova_0921]
Exact relationship: relationship--60ad088f-3133-4b0c-a441-e1e06fff1765 - S1077 Hornbill — malware.
Hornbill can collect the device ID, model, manufacturer, and Android version. It can also check available storage space and if the screen is locked.[lookout_hornbill_sunbird_0221]
Exact relationship: relationship--54bfecbc-4d1d-4bca-bb9c-652d09b29515 - S1079 BOULDSPY — malware.
BOULDSPY can collect system information, such as Android version and device identifiers.[lookout_bouldspy_0423]
Exact relationship: relationship--a25a0454-d6da-4448-a3c5-33648ee6675a - S1082 Sunbird — malware.
Sunbird can exfiltrate the victim device ID, model, manufacturer, and Android version.[lookout_hornbill_sunbird_0221]
Exact relationship: relationship--6a813057-5fe0-46b5-89a3-c804d223568c - S1083 Chameleon — malware.
Chameleon has the ability to gather basic device information, such as version, model, root status, and country.[cyble_chameleon_0423] Chameleon has also checked the restricted settings status of the device. If the Android 13 Restricted Settings status is present, an HTML page with instructions on how to enable the Accessibility Service will be shown to the user. Additionally, Chameleon has checked the keyguard’s status regarding how the device is locked (e.g. pattern, PIN or password).[ThreatFabric_Chameleon_Dec2023]
Exact relationship: relationship--06e2e07f-7835-4ef8-bcc0-bb5e2886839d - S1094 BRATA — malware.
BRATA can retrieve Android system and hardware information.[securelist_brata_0819]
Exact relationship: relationship--583720d0-8b15-4662-822e-bb40bc1df940 - S1095 AhRat — malware.
AhRat can obtain device info such as manufacturer, device ID, OS version, and country.[welivesecurity_ahrat_0523]
Exact relationship: relationship--c32cbb0c-b5d7-44ad-94aa-43e2fbade91d - S1126 Phenakite — malware.
Phenakite can collect device metadata.[fb_arid_viper]
Exact relationship: relationship--99011840-f920-44d1-82f9-a6ff0d4f8c07 - S1185 LightSpy — malware.
LightSpy collects device information, including the phone number, IMEI, CPU details, screen specifications, and memory information.[LinkedIn Dmitry LightSpy 2025][Threatfabric LightSpy 2024][Threatfabric LightSpy 2023][MelikovBlackBerry LightSpy 2024]
Exact relationship: relationship--e4451543-136b-4fe2-a8e2-d005db705aa2 - S1231 GodFather — malware.
GodFather has the ability to gain remote control of the victim device and to gather data associated with the device, including battery level, sound settings, and device brightness.[ZimperiumOrtegaPratapagiri_GodFather_Jun2025] GodFather has also obtained the phone's state, including network information, phone number, and serial number.[MerkleScience_Godfather_April2023]
Exact relationship: relationship--c6d7f454-8dc1-4928-a668-f71aba491e45 - S1241 RatMilad — malware.
RatMilad has collected device information such as model, brand, buildId, Android version and manufacturer.[ZimperiumGupta_RatMilad_Oct2022]
Exact relationship: relationship--904221c2-2486-4e0b-905f-5327ee299097 - S9005 DocSwap — malware.
DocSwap has checked for the `LOCAL_MAC_ADDRESS` permission and has the ability to send system information.[EnkiWhiteHat_KimsukyDOCSWAP_Dec2025][S2W_DocSwap_Mar2025]
Exact relationship: relationship--1c7d2614-c1a6-4193-8053-e5ca8a15437f - S9006 VajraSpy — malware.
VajraSpy has requested for `android.permission.READ_PHONE_STATE` to collect information about the device.[K7Dhanalakshmi_VajraSpy_April2022]
Exact relationship: relationship--7c8dadca-5cc0-40d0-a946-afa99c99cbaf