xhelper | 69344c280d9c6efe22758c2e008920f0823f5bacef27e9c4eb3eab28117d927d

Analysis

max time kernel
131s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
04/08/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xhelper.apk
Size 252KB
Sample260804-tssdcsstfz
SHA256 69344c280d9c6efe22758c2e008920f0823f5bacef27e9c4eb3eab28117d927d
MD5 6f3e67ffe0fae70074d1855a31de58b0
SHA1 52b3a9ca753f16b7dd7f59a408b1b71cc5f36ae0
SHA512 4ef840cbbe8e0a6815e086e4aa04a388d889035dabcbfab3034034cfa4e0350803881475de3b724d00365d966a1298da9e2f23bca913cd20966c5c4746a21ea4
SSDEEP 6144:E1Yf24lyfxjgYIcRbqGQGhFLE5RDRWPwbUcgPVK8:QYJU5UDc84Ffwb/gPVK8
TLSH
T17744126FC9E87ABDE16D07F60433F299E4618181D80AEECA0776DBE8198C57115F4F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion xhelper impact infostealer persistence trojan

Malware Config

Signatures

Family: xHelper
xHelper is a stubborn Android trojan that can reinstall itself after a factory reset.
trojan infostealer xhelper

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.mufc.fireuvw

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mufc.fireuvw/files/firehelper.jar	4303	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mufc.fireuvw/files/firehelper.jar --output-vdex-fd=57 --oat-fd=59 --oat-location=/data/user/0/com.mufc.fireuvw/files/oat/x86/firehelper.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.mufc.fireuvw/files/firehelper.jar	4240	com.mufc.fireuvw

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mufc.fireuvw

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.mufc.fireuvw

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mufc.fireuvw

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.mufc.fireuvw

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.mufc.fireuvw

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.mufc.fireuvw

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mufc.fireuvw

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mufc.fireuvw

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mufc.fireuvw

com.mufc.fireuvw
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4240
- ls /sys/class/thermal
  2⤵
  PID:4278
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mufc.fireuvw/files/firehelper.jar --output-vdex-fd=57 --oat-fd=59 --oat-location=/data/user/0/com.mufc.fireuvw/files/oat/x86/firehelper.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4303

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

01c894627f240fdddc654a0b593b0873.d

Path /data/data/com.mufc.fireuvw/files/01c894627f240fdddc654a0b593b0873.d
Size 32B
SHA256 d7abeb73460649d989a57707975d5dd2616a4ef6aab28bd4952a6625d8ed5762
MD5 f0c8bf6420f960964b3f5a421c6bc81f
SHA1 dd94a085be52ee2ba7d7ae560dfdac57d29d34a2
SHA512 65ad16b42e8c6db16b961657111e56de50da51de2499ab33dbfce242f734dce2ec476e28b490b457e64f2f8c221fc9dea01caa06fd0c7864f733d4ddc2a88c50
MD5 SHA1 SHA512

Submit Download

firehelper.jar

Path /data/data/com.mufc.fireuvw/files/firehelper.jar
Size 21KB
SHA256 b678a11102acbf3d118fa6b4d153d6c9bcc93e4a9530fcb8a7c5e0f985c70857
MD5 e9fbfb4a5a2af96193ddaa105c9139ef
SHA1 4f29fa3cbbbd5eb175ad4185b6d6a3923778d742
SHA512 ea217f4be3129069f8c681206e4b1155f92f7de99cca420183c4d8118c3738ccbe5df1c9e5dd7b95fddd57341e64d9ae45555f7b1efa13df335267053ab6746c
SSDEEP 384:SlWPdwhIOq4xWhGQbdL+lpi2KmqMq1spVpVYSkVJNVVAju1x7pTERYa3sbr:Sl8cIOq4x8/xeKbMZpVpVBkUoyRYjr
TLSH
T1D9A2E13A70FAE6AB38605D313512D99C4373D23095547E830F7A0BF42AF5A5426E8DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firehelper.jar

Path /data/data/com.mufc.fireuvw/files/firehelper.jar
Size 21KB
SHA256 0e80f9711450da54f7e7650848370f5276319c1627fcc33e2388214e0318d75d
MD5 baa6c2e617cf078af55f93b8c6892864
SHA1 ebc5fd019a7e985d661c42e0c7e38501ca7c4046
SHA512 aa22f1016c029fb3a06502d3eb90e8c3d061756add78a34fc9e69c3d8e6e3cbd3aa7f55544618f248980180e8077d486e868cc70a3a701ec9b3388a9cef9dcfc
SSDEEP 384:E/qXw254Fe/y2KLry9FBIco7YLKQw1umXBkKXfu/4VhD9PUr2cCIHNh7FvGm+EZi:81wRKfiFBIbrQGumOKX79PBcCEtHPZru
TLSH
T126A2E1D1BCC34261F049B9FC0BC6293E391DD68687161DD3EBC730546ABEA573A0AD88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dW1weF9pbnRlcm5hbF8xNzg1OTQ0MzE3ODE4

Path /data/data/com.mufc.fireuvw/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzg1OTQ0MzE3ODE4
Size 1KB
SHA256 86dd85b9c60286a14dbc4e2f3cf63211ae9db8f9f57b28781f6b4405824a8b9c
MD5 d880374f507b2dce002a1446797a402d
SHA1 d2fb4987ba46275e59d776682a3d3be90670f439
SHA512 0c2b485d6be8a734ea922e7b033a5db127d99d15067deeb24fc56136974fd6d4601f8e5ae1f54792b9a11874b686df3710281e4892f39692d1c018c36f45a67e
TLSH
T1862117FFA80C5B38E8CD6F209BF1026491203BCD60A81E864241085FAA7B0171EDC80D
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.mufc.fireuvw/files/umeng_it.cache
Size 415B
SHA256 8ead2da64845fd71dfad04a0535253f98a7a41e3a19d726163f53ae0c8086116
MD5 d0ee371e2b51516005d5b6c177b3a4fc
SHA1 319f38676e3c2aaafa3da284012bb8b6c1841e73
SHA512 a057c2f1a94f1a6bb5f9774ab75770d77b2e52df6221ea3529ef38063440a7697a7a005ee7abbaae858e21098b67ad6f333a0af2330ec6c2f123976aa731e380
TLSH
T166E02B98562089D29F11E8B236843242FF0FDA731639064F381B75D99236642FB8435F
MD5 SHA1 SHA512 TLSH

Submit Download

firehelper.jar

Path /data/user/0/com.mufc.fireuvw/files/firehelper.jar
Size 44KB
SHA256 2d625b37127cbaf1025315cc171c602c5dfe79fcab8f9e3eb8e0dec180f981a4
MD5 f6942d8bc53446600abbbf83f6d1d4b7
SHA1 e102621831f1e42ab876413a9a6c7e6373df4ac3
SHA512 9fabb2d002c189e1b1a206ca799c073e98ddac84057f8ecfa80dd3fde9e3f7cbf1cd0fc22a01e48147c5e1f916b718a7e11b9bc4a45e7cffbd4c7ae1e754f59a
SSDEEP 768:Xfo7m3QvfD6+R/OvNn3gd8B9N/ns+J+pPzATUyQ3gDKpT++:vo6Az6+R/oQ23GUUmDg
TLSH
T15523F802A956D923E85E9E7A82F397D66336D3660723474B09CC4678ECCF2D92F1C6C1
MD5 SHA1 SHA512 SSDEEP TLSH

Download

firehelper.jar

Path /data/user/0/com.mufc.fireuvw/files/firehelper.jar
Size 44KB
SHA256 48e844d5d4eb116bb0aaef8e5da85f12958d53a58ecf95d737359b2699a24c82
MD5 efb8c11a1074065497f8776b3b9ee783
SHA1 b62dc0e90c330be4ab7f05af3b8ded922de7acc0
SHA512 bfd6bab60d2c229a17ee9001025dc633d93b68f2247199dc2bf47cedc4da1d3b68914fc969c3b254033c838a53755eee83762901ee2168d291323b09b113dad9
SSDEEP 768:Xfo7m3QvfD6+R/OvNRfufAMTrU0oP2VgbOPzLxyQ3gDKpT++:vo6Az6+R/oRCtVN1mDg
TLSH
T13B23F802F966D853EC5D9A7E92F397926332D76543238B4B0ACC85B8DCCF2D52E486C1
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads