Loading malware…
Ztorg, also known as Qysly, is a large Android malware family active since at least 2015 and associated with multiple monetization schemes and modular infection chains. The family has been observed both as rooting malware and as non-rooting modules distributed through trojanized Android applications, including apps published on Google Play. Ztorg operators have used staged delivery, encrypted embedded payloads, remote retrieval of secondary components, and dynamic code loading to conceal malicious behavior and adapt functionality after installation.
Ztorg variants have been used for premium-rate SMS fraud, subscription fraud, silent app installation, and broader post-compromise activity on Android devices. Trojan-SMS variants can send attacker-directed premium SMS messages, delete incoming SMS messages to suppress billing notifications or confirmation texts, mute device audio during fraudulent actions, and process command data that either triggers SMS transmission or opens monetization URLs. Some related Ztorg components use victim mobile-country and mobile-operator identifiers derived from subscriber information to tailor offers and fraud flows by geography and carrier. Related samples have also used JavaScript-driven clickjacking against WAP billing pages, indicating mobile billing abuse as an additional revenue stream.
Other Ztorg variants act as downloaders or loaders. A documented 2017 variant masquerading as a media application performed extensive anti-analysis checks against Android emulators and instrumented environments before contacting remote infrastructure, downloading an encoded secondary Android payload, decoding it, and loading it invisibly with DexClassLoader for execution. This staged architecture demonstrates a deliberate effort to evade sandboxing and delay exposure of the final payload.
Ztorg has also been linked to campaigns that abused Android Accessibility Services to install promoted applications without user interaction. Some Google Play-distributed samples evolved over time from apparently benign applications into carriers for encrypted Ztorg payloads and later into overt Trojan-SMS functionality, showing that the operators used app updates and modular packaging to extend dwell time and evade store review. Ztorg has been discussed alongside other Android malware families involved in rooting-based monetization ecosystems, including Leech and Gorpo. The malware targets Android devices and is notable for combining store-based distribution, modular payload delivery, anti-analysis, SMS fraud, and mobile subscription abuse.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
I immediately noticed many obfuscated strings... This basically takes the first and last byte as XOR key for the rest of the byte array.
Distributed on Google Play through two malicious apps... The first malicious app, called “Magic browser”... The second app, called “Noise Detector”, with the same malicious functionality...
Just after it receives urls to visit, or SMS to send, the Trojan will turn off the device sound, and start to delete all incoming SMS.
It only runs the malicious part if not on an emulator, which explains why sandboxes won't be able to record any malicious activity.
Checking values in given system files. In particular, it's the first time I have seen malware checking values inside /proc/net/tcp.
After starting, the Trojan will wait for 10 minutes before connecting to its command and control (C&C) server. It uses an interesting technique to get commands from the C&C: it makes two GET requests to the C&C, and in both includes part of the International Mobile Subscriber Identity (IMSI).
The first request will look like this: GET c.phaishey.com/ft/x250_c.txt ... The second request will look like this: GET c.phaishey.com/ft/x25001_0.txt
After analyzing these files, I found out that their main purpose is to perform clickjacking attacks on web pages with WAP billing.
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an infamous Trojan whose JavaScript file names were also seen in Xafecopy, suggesting possible code sharing.
Android malware family distributed via Google Play and outside it. In this report, Ztorg appears both as a rooting malware family and as a Trojan-SMS variant that can send premium-rate SMS, delete incoming SMS, mute device sound, retrieve commands from C2 using IMSI-derived MCC/MNC values, open advertising or WAP billing URLs, and perform clickjacking for WAP billing subscriptions to steal money from victims’ mobile accounts.
Android rooting malware participating in an advertising botnet that obtains root access, installs applications, and distributes additional malware families.
Android malware family that heavily obfuscates strings, performs extensive emulator and taint-environment detection, communicates with a remote server using DES-CBC-encrypted traffic, downloads a secondary APK payload, decodes it with XOR, and loads/executes it invisibly via DexClassLoader.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.