Extracted

• • Target
    084dfef1a1a77a308aa7239239215c49_JaffaCakes118
  • Size 306KB
  • SHA256 65107334ac028116d2d80a285f55c1c64b9d6011fbc5164e5d16fdb8c7bd2729
  • MD5 084dfef1a1a77a308aa7239239215c49
  • SHA1 ab58d16ae11b29709cddd073e8b9d77ac52b5bf9
  • SHA512 00c262b2870d83d404e54267927361c23d251aed2d9513bf5ae2f516faeed1569b365616b446814427a5e3e12c64fbae2fd2a2fe8d1d5095aa417abfe9d54960
  • SSDEEP 6144:brYPWhDJHHKB4cO/xbC7M0zdpGsSrmmqNscZlCbeVyxC9nu33Y:brj29OxWzzdpUTqKxhKnu33Y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries account information for other applications stored on the device

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Registers a broadcast receiver at runtime (usually for listening for system events)

    persistence

  • Acquires the wake lock

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery
  behavioral1behavioral2behavioral3