Exobot
Software · ATTACK:mobile:S0522
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:S0522",
"title": "Exobot",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0522",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--c91cec55-634c-4670-ba10-2dc7ceb28e98",
"external_id": "S0522",
"domain": "mobile",
"created": "2020-10-29T13:32:20.972Z",
"modified": "2026-09-02T18:51:23.098Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Threat Fabric Exobot",
"url": "https://www.threatfabric.com/blogs/exobot_android_banking_trojan_on_the_rise.html"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1624.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f31b209-dbc7-4c7e-bb0a-e37801121c13
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1582
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ad83f33-c64a-4ad6-ab6f-0548c9dde257
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1418.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a18e6c3-4bbf-4418-8815-55ebf283c8a1
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1655.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83358774-0857-429c-9f7a-151403e52881
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1437.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90d4d964-efa2-46ac-adc2-759886e07158
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1476
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6876100-1ed4-4c26-8de7-dc5ee09a8feb
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1636.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b360a1c8-8939-428e-bc6e-3f4755bd9ee0
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1422.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c056b1d4-c70b-403e-b396-18840865ca7d
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1422
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c368c932-7d5a-40e3-a18b-f30e82b9e4e6
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1417.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca8c38e6-8343-4f5e-929d-2759a0d49d59
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1642
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbb48fa1-0677-4a07-bdbf-eda1827e52f1
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1636.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2749285-47d9-44a4-962f-9215e6fb580e
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d724bcf3-25d2-406a-b612-333fea5e2385
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1626.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9aab2e1-31e0-45b2-a40b-0cbe60677b4b
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1426
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da424f3f-8a93-4a66-858c-b33f587108e6
Threat Fabric ExobotATTACK:mobile:S0522 → uses → ATTACK:mobile:T1604
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbdbddd7-4980-4061-9192-24a887bc6bad
Threat Fabric Exobot