Extracted

• • Target
    8f9f510b714d8753c63b8f9ad4588f6148e0898763f4e33dac617e1470ac4d5f.bin
  • Size 282KB
  • SHA256 8f9f510b714d8753c63b8f9ad4588f6148e0898763f4e33dac617e1470ac4d5f
  • MD5 a781b3a58de69b91db2f951428494c22
  • SHA1 5d77f06b0658b865f32f3344c3d3cea02e12d14e
  • SHA512 02f97afbaf979a3a89def8751bdacb542e091d3c00f84ecba68dbe6be85bb67767b8825745dcc6480cd3621c93d6cb86f2533919b5e0b7d71ae86c695f6b198f
  • SSDEEP 6144:IrQY3D0a15sAABXaLVZJdWOYERmHULyU/Zr+XVGkz95xL:Sp3Aa15sAbJUiRecx8GM5h
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloader_apkbankerevasioninfostealerransomwaretrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1
• • Target
    10RP480.db
  • Size 195KB
  • SHA256 8e1a2193c173b12f68557751d82336ff341353bbaf7112bdf3e99ccb55e3dd7e
  • MD5 290ba437670435fddd624fc5a2dbd567
  • SHA1 2ae635e955370eb8ea6c4851c346c9821fd88a31
  • SHA512 82dd7c1939f03d3b30b2fd1115fa96c30e187b30dec58093e3bcd6211390b8a7b4c9aa1354b8428bbeebb50309015238c5185812a3eaa0277e152a75faef6063
  • SSDEEP 6144:6+O2eWaLLZJdyIYEzUHUDiU/ZV+XjGkzK:oTJ8wzwExeGF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral2behavioral3