XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing
Tags
country: China Hong Kong Japan South Korea Taiwan
maec-delivery-vectors: Watering Hole
attack-pattern: Data Broadcast Receivers - T1402 Broadcast Receivers - T1624.001 Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Firmware - T1592.003 Malware - T1587.001 Malware - T1588.001 Phishing - T1660 Phishing - T1566 Server - T1583.004 Server - T1584.004 Software - T1592.002 Vulnerabilities - T1588.006
Show in Graph
Common Information
Type Value
UUID f8e4905d-678b-4eeb-901e-7a85a411b7aa
Fingerprint a5398d09c9f773e9
Analysis status DONE
Considered CTI value 0
Text language
Published April 20, 2018, midnight
Added to db Oct. 15, 2024, 5:14 p.m.
Last updated Oct. 16, 2024, 1:09 a.m.
Headline XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing
Title XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing
Detected Hints/Tags/Attributes 75/3/5
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_se/research/18/d/xloader-android-spyware-and-banking-trojan-distributed-via-dns-spoofing.html
Details Source https://www.trendmicro.com/en_ca/research/18/d/xloader-android-spyware-and-banking-trojan-distributed-via-dns-spoofing.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Attributes
Details Type #Events CTI Value
Details Domain 20 
android.net
Details Domain 6 
android.media
Details Domain 1 
ghd.et
Details File 4 
action.bat
Details File 1 
sms.msg