xloader_apk | d56c3613f8f3274bbb594711781d91bf38fab72668552862b9b8cd4d2d77100b | Triage™

Resubmissions

18/07/2022, 10:22

220718-md8cpsceej10

18/07/2022, 10:18

220718-mb3z7scecr7

Sharing

Copy URL Twitter E-mail

General

Target
agmkqqqmux.apk
Size 260KB
Sample220718-md8cpsceej
SHA256 d56c3613f8f3274bbb594711781d91bf38fab72668552862b9b8cd4d2d77100b
MD5 25c8d132aa493febd3b3458f1f30a173
SHA1 e83e125eaff72de176bd32c61868d44867c4a5c0
SHA512 16be15528dd414914ca7233b1a22c8c1fe763197fe50e9eea0a0ca551df531462d259d591ea9f2e7795dfe9ba287c66040f36a9ebe5247a526ff9d417e1660ab
MD5 SHA1 SHA512

Score

10^/10

xloader_apk banker royalmail infostealer phishing ransomware trojan

Malware Config

Targets

- Target
  agmkqqqmux.apk
- Size 260KB
- SHA256 d56c3613f8f3274bbb594711781d91bf38fab72668552862b9b8cd4d2d77100b
- MD5 25c8d132aa493febd3b3458f1f30a173
- SHA1 e83e125eaff72de176bd32c61868d44867c4a5c0
- SHA512 16be15528dd414914ca7233b1a22c8c1fe763197fe50e9eea0a0ca551df531462d259d591ea9f2e7795dfe9ba287c66040f36a9ebe5247a526ff9d417e1660ab
- MD5 SHA1 SHA512
Score

10^/10

xloader_apk banker royalmail infostealer phishing ransomware trojan
- Detected royalmail phishing page
  phishing royalmail
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Acquires the wake lock.
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Reads information about phone network operator.
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

xloader_apkbankerroyalmailinfostealerphishingransomwaretrojan