MiningDropper Spreads Infostealers, RATs, Banking Malware on Android

MiningDropper is a sophisticated, multi-stage Android dropper framework distributed via trojanized apps and phishing links that first loads XOR-obfuscated native code to decrypt staged DEX payloads and then installs crypto miners or high-impact user payloads (infostealers, BTMOB RAT, banking trojans). The report details obfuscation (XOR, AES, dynamic DEX), anti-emulation checks, split-APK reconstruction, campaign targeting (India, Asia, Europe, LATAM), and telemetry of over 1,500 low-AV-detected samples, underscoring active, large-scale abuse and the need for behavioral detection and MDM controls.