Extracted

• • Target

    4ff47c3193d8de98f38199c1beba42f799146cbceaa5a71ddb9a3e908601fcf2.bin

  • Size

    282KB

  • MD5

    1df97962d03b5e4c188f50daf2b17e6f

  • SHA1

    13af3bb01080c05449c895ac900079e837d34711

  • SHA256

    4ff47c3193d8de98f38199c1beba42f799146cbceaa5a71ddb9a3e908601fcf2

  • SHA512

    41368a9f8c448818b634182cc487b06fdb9c619cccf5a5aefa5745b302f58c23170b495fdeb48794c749c257014ecebdd392c946a7df8cf72c7814a355d95d6f

  • SSDEEP

    6144:0wPZaBXwy+eQ1lSsxMTx3sB09ptgPU/vvrFUt+d68P65sv/DLE7yVLQ4:0sZuXwyN4jMd8B0PtgSvRrHP102Vf

  Score

  10^/10

  xloader_apkbankerevasioninfostealerransomwaretrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1