General
-
Target
3ad960405f81edd876b8c9958dac5a9e2d62af6b51f9363e3165cc40309d44d0.bin
-
Size
412KB
-
Sample
240627-1xasfatbkg
-
MD5
52b4e70970f295cb0647783e5ec8ed9d
-
SHA1
1b908d47a4a578b26995d65e163d60efd7e5fee1
-
SHA256
3ad960405f81edd876b8c9958dac5a9e2d62af6b51f9363e3165cc40309d44d0
-
SHA512
ae0d706a4ae028ce5eed3441e3eb6d6c6bfed895041a9c113e348af09027052425350559fb724c542fbefb7fdb8d16c04e7b538b3fcd862f98219ba7f62ed718
-
SSDEEP
6144:AziCxvB1DbmpdGE4yQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuQ:AziuJ1GpdGtDNUHiiQDhu0vUEbqmEYxV
Static task
static1
Behavioral task
behavioral1
Sample
3ad960405f81edd876b8c9958dac5a9e2d62af6b51f9363e3165cc40309d44d0.apk
Resource
android-x86-arm-20240624-en
Malware Config
Extracted
xloader_apk
http://91.204.227.50:28899
Targets
-
-
Target
3ad960405f81edd876b8c9958dac5a9e2d62af6b51f9363e3165cc40309d44d0.bin
-
Size
412KB
-
MD5
52b4e70970f295cb0647783e5ec8ed9d
-
SHA1
1b908d47a4a578b26995d65e163d60efd7e5fee1
-
SHA256
3ad960405f81edd876b8c9958dac5a9e2d62af6b51f9363e3165cc40309d44d0
-
SHA512
ae0d706a4ae028ce5eed3441e3eb6d6c6bfed895041a9c113e348af09027052425350559fb724c542fbefb7fdb8d16c04e7b538b3fcd862f98219ba7f62ed718
-
SSDEEP
6144:AziCxvB1DbmpdGE4yQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuQ:AziuJ1GpdGtDNUHiiQDhu0vUEbqmEYxV
-
XLoader payload
-
Checks if the Android device is rooted.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the MMS message.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-