MiningDropper – A Global Modular Android Malware Campaign Op...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://cyble.com/blog/miningdropper-global-modular-android-malware/
• Blog Title: MiningDropper – A Global Modular Android Malware Campaign Operating at Scale
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (new page or subsection on: Multi-stage droppers, DexClassLoader dynamic loading, runtime decryption/key-derivation, anti-emulation/root checks)

🎯 Content Summary

Title / context
Cyble Research and Intelligence Labs (CRIL) reports a surge (April 15, 2026) of MiningDropper (aka BeatBanker), a multi-stage, modular Android dropper framework used at scale to deploy (a) a cryptocurrency miner and/or (b) secondary payloads (infostealers, banking trojans, RATs). A key focus is a campaign where the final “user-defined” payload is BTMOB RAT (previously identified by Cyble in February 2024 as a SpySolr<...

🔧 Technical Details

1. Native bootstrap + runtime-only string recovery: A dropper can hide indicators/logic by storing strings XOR-obfuscated inside a native library (.so) and decrypting them only at runtime, then using the native layer to decrypt an embedded payload (e.g., an assets blob) into a DEX and execute it via DexClassLoader, reducing static detection surface and complicating reverse engineering.
   
   2) Filename-derived AES keys to avoid static key extraction: Instead of hardcoding AES keys, derive them from the asset name at runtime (e.g., key = first_16_bytes(SHA1(filename)) or key = first_16_bytes(SHA1(filename + "1"))). This forces analysts to reproduce the naming/key-derivation logic to decrypt the next stage rather than simply grepping constants.
   
   3) Config-driven, stateful multi-payload delivery: Use encrypted configuration files (decrypted at runtime) to select between multiple payload modes (e.g., miner first, then “user-...

🤖 Agent Actions

I’m mapping the mobile/Android section first, then I’ll read the closest existing pages to avoid duplicating content and pick a single file for the update.
I’ve narrowed this to Android app pentesting pages. Next I’m reading the existing Android reversing/deobfuscation and abuse pages to check whether the dropper techniques are already documented and to find the cleanest single insertion point.
The overlap check shows the repo already covers adjacent pieces, but not this exact loader chain: native XOR string recovery, filename-derived AES keying, staged DexClassLoader hops, encrypted split reconstruction, and fake-update gating in one Android dropper pattern. I’m validating the existing README tail now so I can append this cleanly without breaking its structure.
The best fit is the existing Android applications README, specifically its “Android malware tradecraft” block. I’m adding one compact subsection there so the techniques live with adjacent loader and anti-analysis content instead of scattering them across reversing, phishing, and accessibility pages.
The content is in place. I’m re-reading the modified section and the tail references now to confirm the update stayed in one file, kept the HackTricks style, and didn’t create duplicate or malformed markdown.
Updated README.md in src/mobile-pentesting/android-app-pentesting/ with a new subsection under the existing Android malware tradecraft area.

The addition abstracts the useful technique from the blog instead of documenting the malware family itself: native bootstrap + runtime XOR string recovery, root/emulator gating, staged DexClassLoader execution, filename-derived AES keying (SHA1(filename)[:16] / suffix variant), config-driven split payload reconstruction, and fake update UI as background unpacking cover. I also added concise triage points and a small Frida hook example, then appended the Cyble blog and trojanized LumoLight project to the file’s final ## References section.

Verification: only this one file changed, the markdown structure remains valid on inspection, and the references section is still at the end of the file.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://cyble.com/blog/miningdropper-global-modular-android-malware/

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (new page or subsection on: Multi-stage droppers, DexClassLoader dynamic loading, runtime decryption/key-derivation, anti-emulation/root checks)".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0