xloader_apk | 0430c9730f04bdd35934df362f75200ffb395aa525050180b81163e2efb0c512

General

Target

0430c9730f04bdd35934df362f75200ffb395aa525050180b81163e2efb0c512.bin
Size

208KB
Sample

240423-1ys1eacd52
MD5

92d986b79135f470b231cadfa29c04a8
SHA1

4979646ec5ffc2a219f2189baa6f5d9b6b52997e
SHA256

0430c9730f04bdd35934df362f75200ffb395aa525050180b81163e2efb0c512
SHA512

ae0556171f117191fc08152722ffd9f80ae7103149e77b7c7478380e4c54315dd4e7d0fcac210825c5b449ea0bcd217902f09045add383381c588903e8fb5852
SSDEEP

6144:cpHWuD6oxR0EYDLz7WqUwwWKkfkwN3y3ciF0+dRtN:cBR0DLz7SClfkv++dRtN

Score

10^/10

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Targets

- Target
  
  0430c9730f04bdd35934df362f75200ffb395aa525050180b81163e2efb0c512.bin
- Size
  
  208KB
- MD5
  
  92d986b79135f470b231cadfa29c04a8
- SHA1
  
  4979646ec5ffc2a219f2189baa6f5d9b6b52997e
- SHA256
  
  0430c9730f04bdd35934df362f75200ffb395aa525050180b81163e2efb0c512
- SHA512
  
  ae0556171f117191fc08152722ffd9f80ae7103149e77b7c7478380e4c54315dd4e7d0fcac210825c5b449ea0bcd217902f09045add383381c588903e8fb5852
- SSDEEP
  
  6144:cpHWuD6oxR0EYDLz7WqUwwWKkfkwN3y3ciF0+dRtN:cBR0DLz7SClfkv++dRtN
Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence trojan
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
behavioral1