More Than a Miner: The Evasive MiningDropper Framework Hijacking Android Worldwide

A CRIL investigative report describes "MiningDropper", a sophisticated, modular Android malware distribution framework that uses XOR-based native obfuscation, AES-encrypted payload staging, dynamic DEX loading, memory-only deobfuscation, and anti-emulation to evade analysis. The framework can deliver a range of monetization payloads — from silent crypto miners to infostealers and the BTMOB RAT — and has been observed in active, regionally tailored campaigns targeting India and multiple global regions.