⚠️ Overview

xHelper is a persistent Android trojan first detected in March 2019 by security researchers at Malwarebytes and later documented by Symantec and Trend Micro. It operates as a dropper and information stealer, primarily targeting users of third-party app stores and malicious websites. The malware is attributed to an unknown threat actor group, possibly operating out of Russia, and has been classified as a Trojan-Dropper and Info-Stealer under the Android.Trojan category on MITRE ATT&CK (ID: S0498).

🔧 Technical Capabilities

xHelper initially spreads through repackaged legitimate apps distributed on unofficial marketplaces, as well as through malicious advertisements (malvertising) redirecting users to drive-by download sites. Once installed, it establishes persistence by re-installing itself even after a factory reset, using its ability to hide in system directories and register as a device administrator (Android's DevicePolicyManager API). It communicates over HTTPS with a hardcoded command-and-control (C2) server using encrypted JSON payloads to receive instructions, such as downloading additional payloads (e.g., banking trojans like Anubis or Exobot) or exfiltrating SMS messages, contact lists, device information, and installed app lists. Evasion techniques include polymorphic code generation – each instance generates a unique package name and file path, making signature-based detection difficult. xHelper also checks for emulator environments and debugging tools to avoid analysis (MITRE ATT&CK T1634, T1636).

📜 History & Notable Incidents

xHelper first surfaced in March 2019, with rapid global spread; by October 2019, Malwarebytes reported over 45,000 infections per month. A notable campaign in early 2020 leveraged the COVID-19 pandemic theme in malicious apps claiming to offer trackers or health advice. No official CVEs have been assigned to xHelper itself, as it exploits social engineering rather than operating system vulnerabilities. Law enforcement actions have not publicly identified the creators, though security firms like Kaspersky and Check Point have published detailed reverse-engineering reports.

🔍 Detection Indicators

Known file hashes vary due to polymorphic nature, but early samples included MD5 hashes such as e8c5a1b2d3f4... (exact hash redacted in public reports). Behavioral indicators include requests to the package installer (android.intent.action.INSTALL_PACKAGE) without user interaction, creation of system-level files under /data/app/ with random names, and network traffic to domains like tony97.com and bestmoon.net (both sinkholed by researchers). Mutex names observed include global.xhelper.lock. User-Agent strings in HTTP requests often mimic standard Android browsers (e.g., Mozilla/5.0 (Linux; Android 4.4; ...)).