xHelper

xHelper is an Android Trojan that was discovered at the beginning of 2019, but it did not gain much attention due to lacking distinctive features or impressive reach. However, it seems that the operators of this Trojan are serious about its propagation, and xHelper is in the top ten list of most active Android threats currently. This Trojan appears to have two separate variants that are likely to be propagated in the same way – one of the functions in a semi-stealth mode, while the other one tries to be as stealthy as possible by disguising most of its components and keeps them far away from the user's attention.

An Unhelpful Trojan Either Spams You With Advertisements or Adds Other Threats to the Device

Often, Android threats borrow the package names used by popular software so that the user will not think much of them – however, the authors of the xHelper have opted to use the package names of some very obscure applications that have less than a hundred downloads on the Google Play Store. It is not clear why the criminals have opted to adopt this strange strategy.

The semi-stealth variant of the xHelper will avoid attracting the user's attention by skipping the creation of a shortcut and program icons. However, it will not stay away from the notification bar – it will bombard it with numerous notifications, which lead users to online sites that allow them to play browser games. These websites appear to be legitimate and harmless, so it is possible that xHelper's operators might be using a pay-for-click monetization scheme.

A Secondary Payload Brought via Obfuscated 'JAR' File

The stealth variant is far more threatening since its primary purpose is to serve as a first-stage payload that will introduce a secondary threat on a later stage. When the xHelper's stealth version is installed, users will only find its presence in the 'App info' section under the handle 'xhelper.' The Trojan will operate in the background and unpack a heavily obfuscated 'JAR' file that contains the secondary payload. The criminals have taken a lot of steps to prevent researchers from unpacking and analyzing the payload so that it is still impossible to examine the exact contents and code of the unsafe payload. However, there are countless reasons to believe that its purpose is to provide attackers with the ability to execute remote commands on the infected Android device.

The bogus xHelper applications are being hosted on servers based in the United States, and plenty of xHelper's victims are situated in this region. Preventing threats like this one from infecting your Android phone or tablet is of utmost importance so that you should make sure to protect them with a trustworthy anti-malware application. In addition to this, you should avoid downloading dodgy files from the Web, if they were promoted by an unknown page or application especially.