xloader_apk | c65318aa58c9091b938948b62c4b5d6e47237697d8d2f96863f99ef177b6818d

General

Target

4d9a7e425f8c8b02d598ef0a0a776a58_JaffaCakes118
Size

360KB
Sample

240516-3r38xaeh8z
MD5

4d9a7e425f8c8b02d598ef0a0a776a58
SHA1

6326ee3221532268e5d26164376408b28292ff85
SHA256

c65318aa58c9091b938948b62c4b5d6e47237697d8d2f96863f99ef177b6818d
SHA512

45a4c3490855413e23f94338903522fe6199f62b227ee501e986fecc669252e52f5f08c6146e3591ccca1d480ac8eb1bdd6cad74f194d1611c8768e8e3f30248
SSDEEP

6144:p9V8nmTiZi0CoYk8tInWRXVRR18qn4fQXiCIuFN0pnyw7e16qVYZCtQFyx6h/6V:p9MmTiinXBRXV2r49930hekqVYYtAh/2

Score

10^/10

Malware Config

Targets

- Target
  
  4d9a7e425f8c8b02d598ef0a0a776a58_JaffaCakes118
- Size
  
  360KB
- MD5
  
  4d9a7e425f8c8b02d598ef0a0a776a58
- SHA1
  
  6326ee3221532268e5d26164376408b28292ff85
- SHA256
  
  c65318aa58c9091b938948b62c4b5d6e47237697d8d2f96863f99ef177b6818d
- SHA512
  
  45a4c3490855413e23f94338903522fe6199f62b227ee501e986fecc669252e52f5f08c6146e3591ccca1d480ac8eb1bdd6cad74f194d1611c8768e8e3f30248
- SSDEEP
  
  6144:p9V8nmTiZi0CoYk8tInWRXVRR18qn4fQXiCIuFN0pnyw7e16qVYZCtQFyx6h/6V:p9MmTiinXBRXV2r49930hekqVYYtAh/2
Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence privilege_escalation stealth trojan
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Tries to add a device administrator.
  privilege_escalation impact
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

XLoader payload

XLoader, MoqHao

Checks if the Android device is rooted.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Makes use of the framework's foreground persistence service

Queries the phone number (MSISDN for GSM devices)

Reads the content of the MMS message.

Registers a broadcast receiver at runtime (usually for listening for system events)

Tries to add a device administrator.

Acquires the wake lock

Checks if the internet connection is available

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3