SOFTWARE
Arp
at
cmd
Dok
FTP
Net
Orz
Reg
RTM
Tor
yty
SOFTWARE
1-9
A-B
Arp
at
C-D
cmd
Dok
E-F
FTP
G-H
I-J
K-L
M-N
Net
O-P
Orz
Q-R
Reg
RTM
S-T
Tor
U-V
W-X
Y-Z
yty
  1. Home
  2. Software
  3. Xbot

Xbot

Xbot is an Android malware family that was observed in 2016 primarily targeting Android users in Russia and Australia. [1]

ID: S0298
Type: TOOL
Platforms: Android
Version: 1.1
Mobile Layer
download view

Techniques Used

Domain ID Name Use
Mobile T1412 Capture SMS Messages

Xbot steals all SMS message and contact information as well as intercepts and parses certain SMS messages.[1]
Mobile T1471 Data Encrypted for Impact

Xbot can encrypt the victim's files in external storage (e.g., SD card) and then request a PayPal cash card as ransom.[1]
Mobile T1446 Device Lockout

Xbot can remotely lock infected Android devices and ask for a ransom.[1]
Mobile T1411 Input Prompt

Xbot uses phishing pages mimicking Google Play's payment interface as well as bank login pages.[1]

References

  1. Cong Zheng, Claud Xiao and Zhi Xu. (2016, February 18). New Android Trojan “Xbot” Phishes Credit Cards and Bank Accounts, Encrypts Devices for Ransom. Retrieved December 21, 2016.