Malware

Xbot

Xbot is an Android banking trojan and mobile malware family that combines credential phishing, SMS theft, contact harvesting, device locking, and rudimentary ransomware behavior. It has been observed masquerading as legitimate Android applications and using phishing pages that imitate Google Play payment prompts and bank login interfaces to steal payment card data, banking credentials, and related authentication information. The malware can monitor the foreground application and present deceptive overlays or WebView-based phishing content, enabling theft of credentials from targeted financial and payment applications.

Xbot is also capable of stealing all SMS messages and contact data, intercepting and parsing selected SMS messages for banking-related authentication content, and uploading stolen information to command-and-control infrastructure. Additional observed functionality includes sending SMS messages, including premium-rate SMS in some variants, hiding its launcher icon for stealth, persisting across device reboot, downloading and executing additional APK payloads, and receiving remote commands that control phishing and post-compromise actions.

Some Xbot variants abuse device administrator privileges to lock the device, reset the device password, and display a ransom screen. The family has also been documented encrypting files on external storage and demanding payment from victims, although the encryption implementation observed in early reporting was comparatively unsophisticated. Xbot has been described as under active development, with evolving obfuscation and anti-analysis measures including use of DexGuard in later versions. It has been assessed as a successor to the earlier Android trojan Aulrin based on similarities in structure and behavior.

Targeting has included users in Russia, Eastern Europe, and Australia, with particular emphasis on banking fraud and theft of payment information. Distribution has been observed through malicious Android applications and third-party or local app markets rather than exclusively through official channels. Overall, Xbot is best characterized as an Android banking trojan with infostealing, phishing, and limited ransomware capabilities.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1190Exploit Public-Facing ApplicationEvidence1

MORE EFFECTIVE DISTRIBUTION Contextual advertising “Partner” programs Exploits

T1566PhishingEvidence3

Fake device notifications A malicious application could send fake device notifications to the user. Clicking on the device notification could trigger the malicious application to display an input prompt.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

When content is downloaded it can be started by Xbot.

T1059.007JavaScriptEvidence1

The main difference between them is that Xbot implements its behaviors using JavaScript through Mozilla’s Rhino framework

Persistence

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

the malware requests permission to RECEIVE_BOOT_COMPLETED which allows the malware to be persistent on the compromised device, i.e. the malware automatically restarts with the restart of the device.

Privilege Escalation

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

the malware requests permission to RECEIVE_BOOT_COMPLETED which allows the malware to be persistent on the compromised device, i.e. the malware automatically restarts with the restart of the device.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence2

As a part of anti-analysis protection, the author(s) try to obfuscate these samples to make them harder to read.

T1036MasqueradingEvidence2

Xbot will display a fake system notification to the victim with the Google Play logo and the text “Add payment method”... The page looks like Google Play’s actual interface for credit card information.

T1564Hide ArtifactsEvidence1

Meanwhile, the application hides its icon from the launcher so that the user cannot find it anymore.

Credential Access

2 techniques

T1056Input CaptureEvidence2

All information input into this page will be uploaded to its C2 server... If a victim fills out the form, the bank account number, password, and security tokens will be sent to C2 server.

T1649Steal or Forge Authentication CertificatesEvidence2

It parses SMS messages for mTANs (Mobile Transaction Authentication Number) from banks.

Discovery

1 technique

T1033System Owner/User DiscoveryEvidence1

It will collect all contacts’ names and phone numbers and upload them to its C2 server

Collection

2 techniques

T1005Data from Local SystemEvidence1

It will collect all contacts’ names and phone numbers and upload them to its C2 server, as well as all new SMS messages.

T1056Input CaptureEvidence2

All information input into this page will be uploaded to its C2 server... If a victim fills out the form, the bank account number, password, and security tokens will be sent to C2 server.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

The communication with the C&C server uses URL parameters to send the data and a php script to process them.

T1071.001Web ProtocolsEvidence2

After being installed on an Android device, Xbot will start communicating with its C2 server. When certain commands are received it will launch phishing attacks...

T1090.003Multi-hop ProxyEvidence1

The third function is the ability to send SMS messages from the compromised device to any number the author(s) of malware wants.

T1105Ingress Tool TransferEvidence1

The first one is a function responsible for checking if the additional APK exists on /mnt/sdcard/ which allows the malware to download it in case this APK doesn’t exists.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

All information input into this page will be uploaded to its C2 server... upload them to its C2 server, as well as all new SMS messages.

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

It can also remotely lock infected Android devices, encrypt the user’s files in external storage (e.g., SD card), and then ask for a U.S. $100 PayPal cash card as ransom.

T1490Inhibit System RecoveryEvidence2

Then, if the C2 server sends the command “killon”, it will change the phone to silent mode, reset the password to “1811blabla”, then toggle the device screen to activate the new password. | Xbot will also start the onBackPressed(), onDestroy() and onPause() callback methods to prevent the user from exiting.

INDICATORS OF COMPROMISE

IOCs tracked for this family

44 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

12 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

24 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

8 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app11 years ago

hash.sha256●●●●●●●●●●●●View more in app11 years ago

uri●●●●●●●●●●●●View more in app11 years ago

hash.sha256●●●●●●●●●●●●View more in app11 years ago

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

slideshareNews

Jan 1, 2026

Hi-Tech Crime Trends 2016 | PDF

Android banking trojan listed among malware targeting Europe and the USA.

mitre attack websiteNews

Oct 21, 2021

Input Prompt, Technique T1411 - Mobile | MITRE ATT&CK®

Android trojan that mimics Google Play payment and bank login pages to steal financial credentials.

mitre attack websiteNews

Oct 21, 2021

Capture SMS Messages, Technique T1412 - Mobile | MITRE ATT&CK®

Android banking trojan that steals SMS messages and contacts and intercepts/parses selected SMS traffic.

mitre attack websiteNews

Jan 18, 2018

Protected User Data: SMS Messages, Sub-technique T1636.004 - Mobile | MITRE ATT&CK®

Android malware that steals SMS messages and contacts, and intercepts and parses selected SMS traffic.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching44

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Xbot