Extracted

• • Target
    52ec881f79f4e7bf8ee67193d0abe01c906f8007b1ecb87e353e4769e5f2e93b.bin
  • Size 283KB
  • SHA256 52ec881f79f4e7bf8ee67193d0abe01c906f8007b1ecb87e353e4769e5f2e93b
  • MD5 39039066535840b9ea41559b236eec7d
  • SHA1 de08f1534dd869daf1fc8d1bcf1bbee43f55d0bc
  • SHA512 2b776021d2b8ace55a62957c1f0413786f23c6ebcf06bf76fd86b9a35c5fdcbe66449fd1db82d710fd556880035b8bf976359aec2138b3c577479b15109cd6a3
  • SSDEEP 6144:1e+qN6Dj+uAoogmp6uIZkpBcxqjpDYwpUt2YM7o5jnqoc:19qN6D1ogO6H0xYucmos3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloader_apkbankerevasioninfostealerransomwaretrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1