General
- Target xhelper.apk
- Size 252KB
- Sample260807-nkl9gstfrb
- SHA256 69344c280d9c6efe22758c2e008920f0823f5bacef27e9c4eb3eab28117d927d
Score
10/10
Malware Config
Targets
-
- Target xhelper.apk
- Size 252KB
- SHA256 69344c280d9c6efe22758c2e008920f0823f5bacef27e9c4eb3eab28117d927d
Score10/10Family: xHelper
xHelper is a stubborn Android trojan that can reinstall itself after a factory reset.
Checks if the Android device is rooted.
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
Queries information about active data network
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Queries the mobile country code (MCC)
Queries the unique device ID (IMEI, MEID, IMSI)
Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1