General
-
Target
92ae47cfd41628774e136f60401e9adf6c5c3f20becb4f94da6a76eb4d0bd9d5.bin
-
Size
408KB
-
Sample
240627-1xqhwswcql
-
MD5
707738c4ca3fe530c139d369230f098d
-
SHA1
e8e8d400c3268c1429e74418ceb13f71f71f1eb4
-
SHA256
92ae47cfd41628774e136f60401e9adf6c5c3f20becb4f94da6a76eb4d0bd9d5
-
SHA512
15d631e95cede528ee0b739042a05a1ded02a9c155122928c244af0bbc8238350ebd845f247927bda06deecaecacead0f73e2811bc1673b468e88c4d2038f232
-
SSDEEP
6144:zNfh70hXZNGDrw4yQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuBKuX:H0oDrwUDNUHiiQDhu0vUEbqmEYxHuX
Static task
static1
Behavioral task
behavioral1
Sample
92ae47cfd41628774e136f60401e9adf6c5c3f20becb4f94da6a76eb4d0bd9d5.apk
Resource
android-x86-arm-20240624-en
Malware Config
Extracted
xloader_apk
http://91.204.227.50:28899
Targets
-
-
Target
92ae47cfd41628774e136f60401e9adf6c5c3f20becb4f94da6a76eb4d0bd9d5.bin
-
Size
408KB
-
MD5
707738c4ca3fe530c139d369230f098d
-
SHA1
e8e8d400c3268c1429e74418ceb13f71f71f1eb4
-
SHA256
92ae47cfd41628774e136f60401e9adf6c5c3f20becb4f94da6a76eb4d0bd9d5
-
SHA512
15d631e95cede528ee0b739042a05a1ded02a9c155122928c244af0bbc8238350ebd845f247927bda06deecaecacead0f73e2811bc1673b468e88c4d2038f232
-
SSDEEP
6144:zNfh70hXZNGDrw4yQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuBKuX:H0oDrwUDNUHiiQDhu0vUEbqmEYxHuX
-
XLoader payload
-
Checks if the Android device is rooted.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the MMS message.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-