General
-
Target
3c42c3605c16384b28bb4510148e9a21fe4468c6b0db126269e0ba69a8630a1c.bin
-
Size
412KB
-
Sample
240627-1xkbwawcnm
-
MD5
5fbe32ff8c94428571b08ae95fe49553
-
SHA1
fe673457b644825969612ec30b1f4cd6e974b34b
-
SHA256
3c42c3605c16384b28bb4510148e9a21fe4468c6b0db126269e0ba69a8630a1c
-
SHA512
cafbc70e43c39668c986c072c2fa30f38e2710aaec3ed0ccd7b0b1c94e01172ce719a581d05283fcb1a0e5d9b30ab21fead3e1caaafdc8c4a242d827b428f589
-
SSDEEP
6144:NOYyQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuX1AaVFYtSwGIfLDbunF/:dDNUHiiQDhu0vUEbqmEYx4pwGIfvynF/
Static task
static1
Behavioral task
behavioral1
Sample
3c42c3605c16384b28bb4510148e9a21fe4468c6b0db126269e0ba69a8630a1c.apk
Resource
android-x86-arm-20240624-en
Malware Config
Extracted
xloader_apk
http://91.204.227.50:28899
Targets
-
-
Target
3c42c3605c16384b28bb4510148e9a21fe4468c6b0db126269e0ba69a8630a1c.bin
-
Size
412KB
-
MD5
5fbe32ff8c94428571b08ae95fe49553
-
SHA1
fe673457b644825969612ec30b1f4cd6e974b34b
-
SHA256
3c42c3605c16384b28bb4510148e9a21fe4468c6b0db126269e0ba69a8630a1c
-
SHA512
cafbc70e43c39668c986c072c2fa30f38e2710aaec3ed0ccd7b0b1c94e01172ce719a581d05283fcb1a0e5d9b30ab21fead3e1caaafdc8c4a242d827b428f589
-
SSDEEP
6144:NOYyQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuX1AaVFYtSwGIfLDbunF/:dDNUHiiQDhu0vUEbqmEYx4pwGIfvynF/
-
XLoader payload
-
Checks if the Android device is rooted.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the MMS message.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-