{"id":12413,"date":"2025-04-01T10:50:42","date_gmt":"2025-04-01T10:50:42","guid":{"rendered":"\/cybersecurity-blog\/?p=12413"},"modified":"2025-04-02T05:49:54","modified_gmt":"2025-04-02T05:49:54","slug":"salvador-stealer-malware-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/salvador-stealer-malware-analysis\/","title":{"rendered":"Salvador Stealer: New Android Malware That Phishes Banking Details & OTPs"},"content":{"rendered":"\n

In this report, we examine an Android malware sample recently collected and analyzed by our team. This malware masquerades as a banking application and is built to steal sensitive user information. During the analysis, we came across internal references to “Salvador,”<\/strong> so we decided to name it Salvador Stealer. <\/p>\n\n\n\n

Real-time visibility into mobile malware behavior is crucial for security teams, SOC analysts, and mobile app providers. This analysis demonstrates how advanced threats can bypass user trust and steal sensitive data, highlighting the need for dynamic malware analysis solutions. <\/p>\n\n\n\n

Salvador Stealer Overview <\/h2>\n\n\n\n

The collected malware sample is a dropper that delivers a banking stealer masquerading as a legitimate banking app. Its primary goal is to collect sensitive user information, including: <\/p>\n\n\n\n