MoqHaoMalware
- Formbook
- shaoye
- win.xloader
- wroba
- XLoader
MoqHao, also called Wroba and XLoader (not to be confused with the malware of the same name for Windows and macOS), is an Android-based mobile threat that is associated with a financially motivated Chinese group called Roaming Mantis. The malware claims to be the default SMS application and has dropper and banker capabilities.From MISP Galaxy
Last reported 23 days ago, by ESET WeLiveSecurity (ES)9 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1027.014Polymorphic Code
“In this blog post, Zscaler ThreatLabz explores the anti-analysis techniques that GuLoader employs including polymorphic code to dynamically construct constant and string values, as well as complex exception-based control flow obfuscation.”
- T1055Process Injection
“Doing so will help to identify family-recurring patterns, like process injection, unique file paths, or creating the same file every time.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“Detrás se posicionaron familias tradicionales de alto volumen como AgentTesla, Formbook y SnakeStealer, coexistiendo con el avance de variantes modernas optimizadas para evasión como LummaStealer y Rhadamanthys.”
-
August 2026 Infostealer Trend Report“In email distributing Infostealer cases, the Formbook infostealer—disguised as an email notifying recipients of Turkish bank account transaction statements—and the AgentTesla infostealer—disguised as a request for new business and quotes from an Indian plumbing company—were ident…”
-
Panorama de amenazas digitales en México: qué cambió en el primer semestre de 2026“…ute;xico existió una circulación regular y simultánea de familias tradicionales como AgentTesla (0,95% nacional) y Formbook (0,26%), complementadas por la presencia de variantes evasivas modernas como LummaStealer y Rhadamanthys.”
-
Risky Bulletin: Dutch intel services to get extensive new powers“XLoader to ScreenConnect campaign: The Deception.Pro team looks at a campaign captured in its deception environment, where an operator used a PDF phishing lure to deploy the XLoader RAT and then run a hands-on-keyboard intrusion through ScreenConnect.”
-
Latest Xloader Obfuscation Methods and Network Protocol“Latest Xloader Obfuscation Methods and Network Protocol”
-
Panorama infostealer: cambios globales y casos destacados en México y Brasil“… el año que pasó: tras el abandono del desarrollo de Agent Tesla por parte de sus creadores, familias como SnakeStealer y Formbook tomaron el liderazgo.”
-
Technical Analysis of GuLoader Obfuscation Techniques“It is primarily used to deliver secondary payloads — including remote access trojans (RATs) and information stealers such as XLoader, AgentTesla, and FormBook — by retrieving encrypted payloads from legitimate cloud services like Google Drive and OneDrive.”
-
ESET Threat Report H2 2025“…rvice downloader and cryptor is used to deploy other malware, including ransomware, as well as infostealer juggernauts such as Rescoms, Formbook, and Agent Tesla.”
-
5 ways to leverage our Malware Reports for malware analysis“The results indicate that the threat can likely be attributed to the Formbook malware.”
Indicators in its reports
named in the reports above- 90de01c5ff417f23…aced410f1b95in 1 report
- 274329db2d871d43…603f72be9303in 1 report
- 4be24d314fc9b2c9…b635745e997bin 1 report
- 0bcc5819a83a3ad0…fe387af58067in 1 report
- 7fccb9545a51bb6d…af405cbba6e9in 1 report
- 53bad49e755725c8…decd719b501din 1 report
- hxxps://github[.]com/nfcgate/nfcgate/wikiin 1 report
- 015eab9d9dfbb6479f6001b0ec5d5f7cin 1 report
- 01751fdcd020df3de36c18b2c65e319cin 1 report
- 01b0c7fb95f3bd473afc02c295b6acccin 1 report
- 01cd5d41e875224867c385ae931b7b4ein 1 report
- 01dfd32fa42c976b09bad618a84ebc67in 1 report
- www.lorvag[.]xyzin 1 report
- nitter[.]netin 1 report
- xcancel[.]comin 1 report
- patak[.]catin 1 report
- micahflee[.]comin 1 report
- jillian.bsky[.]socialin 1 report
- reason[.]comin 1 report
- evangreer.bsky[.]socialin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.