xloader_apk | e97505e01e2ea12a89c78430e4a7f3e1275bef1bb442f471b9d3a63f028c9a70

Analysis

max time kernel
4265100s
max time network
140s
platform
android_x86
resource
android-x86-arm-20231023-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
submitted
23/11/2023, 22:01

Target
e97505e01e2ea12a89c78430e4a7f3e1275bef1bb442f471b9d3a63f028c9a70.apk
Size 441KB
Sample231123-1xjeksde8x
SHA256 e97505e01e2ea12a89c78430e4a7f3e1275bef1bb442f471b9d3a63f028c9a70
MD5 a1c35f09ca19d93c647ee422f0e90e22
SHA1 a9d33e140261a29fe23594874bb37ad3324f68c3
SHA512 33ca604e3b93dd626ffa6868b6f9d8df16e7f89ddac46984c4cee59943bf56670d71c63a8201eb3284b3e2f6433df3652cbe554d206faaaf72fecb8dfaa3d165
SSDEEP 12288:g1K3fskbykBvJAay2gVtmE85m6AL5udOVKzfpuo7zZ+:rfscykBvJpy2AGjAL5Yvw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

XLoader payload 6 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_xloader_apk
behavioral1/files/fstream-1.dat	family_xloader_apk2
behavioral1/memory/4272-0.dex	family_xloader_apk
behavioral1/memory/4272-0.dex	family_xloader_apk2
behavioral1/memory/4272-1.dex	family_xloader_apk
behavioral1/memory/4272-1.dex	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk

Removes its main activity from the application launcher 1 IoCs

pid	Process
4272	pzod.qkml.dwfyp.op.kwuk.kkqb.dyxyoq

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	pzod.qkml.dwfyp.op.kwuk.kkqb.dyxyoq

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/pzod.qkml.dwfyp.op.kwuk.kkqb.dyxyoq/files/d	4272	pzod.qkml.dwfyp.op.kwuk.kkqb.dyxyoq
/data/user/0/pzod.qkml.dwfyp.op.kwuk.kkqb.dyxyoq/files/d	4272	pzod.qkml.dwfyp.op.kwuk.kkqb.dyxyoq

Path /data/data/pzod.qkml.dwfyp.op.kwuk.kkqb.dyxyoq/files/d
Size 453KB
SHA256 5c25ea3bbc2a4ca578fa198b9a33fdb3d51e829b274b22af75768c3b22fa962d
MD5 d125d7e8d3e1bd80e89df9ebb0522296
SHA1 b1d6d142a5f67661a555000726e0ab72ca43ce7b
SHA512 aac0eb838beeb6e38b2226798359cee9ae4b937724f108e3dea5bd3307964810cb4ba09368e71eaf4b9551624ff4886a02ee5d72022f8487a2e6dc540a4fa42e
SSDEEP 12288:I6WB0hah9NL9XvXF061+GB8m/CbEcaLlDPrQNyfQQ:I6WB0EfNxF0678m/CbEcaLhuyfQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/user/0/pzod.qkml.dwfyp.op.kwuk.kkqb.dyxyoq/files/d
Size 453KB
SHA256 5c25ea3bbc2a4ca578fa198b9a33fdb3d51e829b274b22af75768c3b22fa962d
MD5 d125d7e8d3e1bd80e89df9ebb0522296
SHA1 b1d6d142a5f67661a555000726e0ab72ca43ce7b
SHA512 aac0eb838beeb6e38b2226798359cee9ae4b937724f108e3dea5bd3307964810cb4ba09368e71eaf4b9551624ff4886a02ee5d72022f8487a2e6dc540a4fa42e
SSDEEP 12288:I6WB0hah9NL9XvXF061+GB8m/CbEcaLlDPrQNyfQQ:I6WB0EfNxF0678m/CbEcaLhuyfQQ
MD5 SHA1 SHA512 SSDEEP

Download

Path /data/user/0/pzod.qkml.dwfyp.op.kwuk.kkqb.dyxyoq/files/d
Size 453KB
SHA256 5c25ea3bbc2a4ca578fa198b9a33fdb3d51e829b274b22af75768c3b22fa962d
MD5 d125d7e8d3e1bd80e89df9ebb0522296
SHA1 b1d6d142a5f67661a555000726e0ab72ca43ce7b
SHA512 aac0eb838beeb6e38b2226798359cee9ae4b937724f108e3dea5bd3307964810cb4ba09368e71eaf4b9551624ff4886a02ee5d72022f8487a2e6dc540a4fa42e
SSDEEP 12288:I6WB0hah9NL9XvXF061+GB8m/CbEcaLlDPrQNyfQQ:I6WB0EfNxF0678m/CbEcaLhuyfQQ
MD5 SHA1 SHA512 SSDEEP

Download