Extracted

• • Target

    3f66c4095e1943b41aa881e1be34db4f3f338eacfd3cc25794e06bc6d83088d3.bin

  • Size

    283KB

  • MD5

    68a65c7b70c6bc96970a973ee5450415

  • SHA1

    166d6d5cef5a067aa2e96671af5026a42c77b708

  • SHA256

    3f66c4095e1943b41aa881e1be34db4f3f338eacfd3cc25794e06bc6d83088d3

  • SHA512

    950f529165a296475f8c230f0649a5e241503d6b4120b34879444a88c194a3b91905f8c7ac2b6322be9613882b58b0dbf39ffd53b8870f908f906c15e12c5eaf

  • SSDEEP

    6144:Rt4r6F9RtNAOXZ3UAmH9CjNqvbIRh9FCxMcuJz5yu+SiT:RtJjYOdNe9CAOh9FCx3cyuiT

  Score

  10^/10

  xloader_apkbankerevasioninfostealerransomwaretrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1