MoqHao
Aliases: Shaoye, Wroba, XLoader
- First seen
- 2017-09-01 00:00:00
- Malware type
- dropper, trojan
- Family
- Malware family
- Last IoC activity
- 2026-07-22 00:31:42
- Profile updated
- 2026-07-07 12:59:41
Targeted industries: financial-services
Targeted regions: country_code:jp country_code:kr country_code:tw
Context
MoqHao, also called Wroba and XLoader (not to be confused with the malware of the same name for Windows and macOS), is an Android-based mobile threat that is associated with a financially motivated Chinese group called Roaming Mantis. The malware claims to be the default SMS application and has dropper and banker capabilities.
Reports & references
- Trend Micro — A Look Into The Connection Between Xloader And Fakespy And Their Possible Ties With The Yanbian Gang (report)
- Trend Micro — Xloader Android Spyware And Banking Trojan Distributed Via Dns Spoofing (report)
- medium.com — The Roamingmantis Groups Expansion To European Apple Accounts And Android Devices E6381723C681 (report)
- Trend Micro — A Look Into The Connection Between Xloader And Fakespy And Their Possible Ties With The Yanbian Gang (report)
- Kaspersky — 96250 (report)
- malpedia.caad.fkie.fraunhofer.de — Apk.Moqhao (report)
- xanhacks.xyz — Moqhao Malware Analysis (report)
- team-cymru.com — Moqhao Part 1 Identifying Phishing Infrastructure (report)
- cryptax.medium.com — A Native Packer For Android Moqhao 6362A8412Fe1 (report)
- Broadcom/Symantec — Moqhao Malware Continues To Target Mobile Users In Europe (report)
- kashifali.ca — Roaming Mantis Amplifies Smishing Campaign With Os Specific Android Malware (report)
- team-cymru.com — Moqhao Part 1 5 High Level Trends Of Recent Campaigns Targeting Japan (report)
- hitcon.org — D2 S1 R1 (report)
- team-cymru.com — Moqhao Part 3 Recent Global Targeting Trends (report)
- blog.sekoia.io — Ongoing Roaming Mantis Smishing Campaign Targeting France (report)
- telekom.com — Moqhao Masters New Tricks 1031484 (report)
- jsac.jpcert.or.jp — Jsac2020 4 Ogawa Niseki En (report)
- Kaspersky — 108464 (report)
- team-cymru.com — Moqhao Part 2 Continued European Expansion (report)