General
-
Target
2e957ebd72f77bc3b740c69902d2a2a61ab18b53d72ef0df7c0a04a9e7712ca0.bin
-
Size
412KB
-
Sample
240619-c5d8tswhll
-
MD5
ff18fe7833f4f65170289e552761e69a
-
SHA1
7b0aa0109a0bd5254843b198942530a910cc4b28
-
SHA256
2e957ebd72f77bc3b740c69902d2a2a61ab18b53d72ef0df7c0a04a9e7712ca0
-
SHA512
07c9469bc2b56523cfe5d12da426dd39335ea5f8884d2ca3feee1fa8db65279342c04a11e4bbe0c89eaa0d8af8101c6bb46ed2f4aa41c8a9c0f2d3e2be9982cb
-
SSDEEP
12288:a6C8dR+5yt7RlScl3evk6OR7jwflvqn+p:a6C8ayBzlj60s9Zp
Static task
static1
Behavioral task
behavioral1
Sample
2e957ebd72f77bc3b740c69902d2a2a61ab18b53d72ef0df7c0a04a9e7712ca0.apk
Resource
android-x86-arm-20240611.1-en
Malware Config
Extracted
xloader_apk
http://91.204.227.50:28899
Targets
-
-
Target
2e957ebd72f77bc3b740c69902d2a2a61ab18b53d72ef0df7c0a04a9e7712ca0.bin
-
Size
412KB
-
MD5
ff18fe7833f4f65170289e552761e69a
-
SHA1
7b0aa0109a0bd5254843b198942530a910cc4b28
-
SHA256
2e957ebd72f77bc3b740c69902d2a2a61ab18b53d72ef0df7c0a04a9e7712ca0
-
SHA512
07c9469bc2b56523cfe5d12da426dd39335ea5f8884d2ca3feee1fa8db65279342c04a11e4bbe0c89eaa0d8af8101c6bb46ed2f4aa41c8a9c0f2d3e2be9982cb
-
SSDEEP
12288:a6C8dR+5yt7RlScl3evk6OR7jwflvqn+p:a6C8ayBzlj60s9Zp
-
XLoader payload
-
Checks if the Android device is rooted.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the MMS message.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-