MiningDropper – Global Modular Android Malware Campaign with XMRig Cryptomining, Banking Trojan, and RAT Payloads — Threadlinqs Intelligence
As of 2026-05-30, MiningDropper – Global Modular Android Malware Campaign with XMRig Cryptomining, Banking Trojan, and RAT Payloads is a high-severity malware threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-0369 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: MALWARE
Attribution: N/A · FINANCIAL
Sophisticated modular Android dropper framework operating at global scale, combining XMRig Monero cryptomining, banking trojan overlays with USDT transaction interception, and full-featured RAT
MiningDropper represents a modular Android malware ecosystem comprising several interrelated families — BeatBanker, RewardDropMiner, and BTMOB RAT — operating as a coordinated campaign targeting mobile users globally, with primary focus on Brazil and India.
The infection chain begins with social engineering via counterfeit Google Play Store replicas (e.g., cupomgratisfood[.]shop) and phishing links distributed through WhatsApp and malvertising on Facebook. Dropper apps masquerade as legitimate government, banking, or utility applications such as "INSS Reembolso" (Brazil social security), "PM YOJANA 2025", "RTO Challan", and "SBI Online" (India banking).
The malware employs a sophisticated two-stage native library packing mechanism. The initial APK contains libludwwiuh.so, which decrypts an embedded ELF binary renamed l.so. This second-stage loader uses dalvik.system.InMemoryDexClassLoader to load malicious DEX payloads directly into memory, completely bypassing filesystem-based detection. The l.so loader employs XOR stack strings to encrypt Java method names at runtime, making static analysis extremely difficult.
Anti-analysis capabilities include runtime emulation detection, CPU architecture validation (CPU_ABI checks), and immediate process self-termination via android.os.Process.killProcess() when sandbox environments are detected. The dropper architecture is specifically designed to evade Google's Pilot Program scanning, which monitors for high-risk permissions (RECEIVE_SMS, READ_SMS, BIND_Notifications, Accessibility Services) in apps distributed in India, Brazil, Thailand, and Singapore.
The cryptomining module deploys XMRig 6.17.0 compiled for ARM architecture, connecting to pool.fud2026[.]com:9000 with TLS encryption and NiceHash protocol support. Miner binaries are encrypted using SHA-1 hash of the filename as the decryption key, ensuring unique encryption per version. The malware continuously monitors device telemetry — charging status, battery level, temperature, screen lock state, and installation age — to optimize mining activity and avoid user detection.
The banking trojan component targets cryptocurrency applications including Binance and Trust Wallet, as well as major browsers (Chrome, Firefox, Brave, Opera, Edge, DuckDuckGo). When users initiate USDT withdrawals, the trojan overlays the transaction confirmation screen with a highly realistic phishing page sourced from Base64-encoded HTML, using AccessibilityNodeInfo.ACTION_SET_TEXT to replace destination wallet addresses with attacker-controlled addresses.
Firebase Cloud Messaging (FCM) serves as the primary C2 channel, with the malware supporting 32+ remote commands including Google Authenticator monitoring (goauth), microphone recording (srec), USDT address replacement (usdtress), real-time screen text submission (SCRD), factory reset (adm/wip), and SMS spoofing (ssms).
Persistence is maintained through an innovative audio-loop technique: a KeepAliveServiceMediaPlayback component continuously loops a five-second MP3 file (output8.mp3) containing Chinese language content, preventing the Android OS from terminating the malicious service. A fixed foreground notification simulating system updates provides additional persistence.
Recent variants have evolved to drop BTMOB RAT — a Malware-as-a-Service tool descended from CraxsRAT and CypherRAT families — replacing the banking module entirely. BTMOB provides full remote device control including automatic permission grants, camera access, keystroke capture, and lock credential harvesting. BTMOB source code has leaked on dark web forums, enabling broader operator adoption. The BTMOB RAT was promoted via GitHub account "brmobrats" as early as July 2025.
The RewardDropMiner variant targets Indian users with dropper apps mimicking government and banking services. Recent RewardDropMiner.B variants have stripped the mining component and fallback spyware, focusing purely on dropper functionality for delivering sec
Weaknesses (CWE)
CWE-94, CWE-829, CWE-693, CWE-300
Target sectors: financial, cryptocurrency, government, consumer, banking, mobile-users
Target regions: Brazil, India, Thailand, Singapore, South Korea, Indonesia, Asia-Pacific, Latin America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1195, T1204, T1204, T1106, T1543, T1546, T1548, T1027, T1140