Tool.NPMod
Tool.NPMod is Dr.Web’s detection name for Android apps modified with the NP Manager utility. It is classified in the provided content as riskware rather than a malware family. NP Manager-modified apps were described as among the most active and widespread riskware programs observed in 2025, including being the most widespread riskware category in Dr.Web’s Q4 2025 Android telemetry. According to the content, NP Manager can modify Android applications to obfuscate and protect their code and embed functionality that bypasses digital signature verification after modification. The content does not attribute Tool.NPMod to a specific threat actor, campaign, or industry target, and it does not provide specific indicators of compromise beyond the fact that affected apps are modified using NP Manager and include signature-verification-bypass capability.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence
1 technique
Persistence
Stealth
2 techniques
Stealth
widely common were apps to which junk code had been added to obfuscate their logic... Since last fall, these tools are actively being used in the Android.Banker.Mamont trojan family to evade anti-virus detection.
Topping the list of the most commonly detected potentially dangerous software were apps to which junk code has been added with the help of Android program modification tools... Currently, this technique is actively being used to protect banking trojans from anti-virus detection.
Defense Impairment
1 technique
Defense Impairment
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
App modification/obfuscation tool used to protect modified apps and bypass signature verification; frequently leveraged by threat actors to hinder detection and analysis.
NP Manager-based app modification that obfuscates code and embeds a module to bypass Android signature verification after modification.
Android app-modification tool/module used to bypass digital signature verification in modified apps.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.