In this case, the malware uses Gymdrop dropper to download an advanced Android Banking Trojan to infect the victim’s device. Various malware families use the Dropper as a Service (DaaS) model to bypass the security mechanisms implemented by the Google Play Store. Figure 1 – Hadoken Security Postīased on our detailed investigation, the sample was identified as a new variant of MasterFred, which uses Gymdrop to download Xenomorph Android Banking Trojan.

The Threat Actor (TA) known as Hadoken Security (a group of malware developers) is behind the development of this MasterFred malware, including Xenomorph, MaqSpy RAT, and Gymdrop dropper. While conducting a routine threat hunting exercise, CRL came across a Twitter post where the security researcher mentioned the sample of MasterFred hosted on opendir malicious website hxxp://repo.had0k3ntech. Cyble Research Labs (CRL) published a detailed technical analysis of MasterFred after its discovery, and we have been closely monitoring the activity of evolving Banking Trojans. MasterFred was discovered in November 2021 as an undetected new variant of the Android Banking Trojans targeting Poland and Turkey.

Hostile Downloader Masquerading As “QR Scanner” Application

Download xenomorph mantis