{"id":16169,"date":"2019-08-26T12:10:06","date_gmt":"2019-08-26T20:10:06","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/08\/26\/news-9912\/"},"modified":"2019-08-26T12:10:06","modified_gmt":"2019-08-26T20:10:06","slug":"news-9912","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/08\/26\/news-9912\/","title":{"rendered":"Mobile Menace Monday: Android Trojan raises xHelper"},"content":{"rendered":"

Credit to Author: Nathan Collier| Date: Mon, 26 Aug 2019 19:04:13 +0000<\/strong><\/p>\n

Back in May, we classified what we believed was just another generic Android\/Trojan.Dropper<\/a>, and moved on. We didn\u2019t give this particular mobile malware much thought until months later, when we started noticing it had climbed onto our top 10 list of most detected mobile malware. <\/p>\n

Henceforth, we feel a piece of mobile malware with such a high number of detections prompts a proper name and classification. Therefore, we now call it Android\/Trojan.Dropper.xHelper. Furthermore, this prominent piece of malware deserves a closer look. Let\u2019s discuss the finer points of this not-so-helpful xHelper.<\/p>\n

Package name stealer<\/h3>\n

The first noticeable characteristic of xHelper is the use of stolen package names. It isn\u2019t unusual for mobile malware to use the same package name of other legitimate apps. After all, the definition of a Trojan<\/a> as it relates to mobile malware is pretending to be a legitimate app. However, the package names this Trojan has chosen is unusual.<\/p>\n

To demonstrate, xHelper uses package names starting with “com.muf.” This package name is associated with a number of puzzle games found on Google Play, including a puzzle called New2048HD with the package name com.mufc.fireuvw<\/a>. This simple game only had a little more than 10 installs at the time of this writing. Why this mobile malware is ripping off package names from such low-profile Android apps is a puzzle in itself. In contrast, most mobile Trojans rip off highly-popular package names.<\/p>\n