Extracted

• • Target

    f27f5089d1ffcae39029ef86a93b884e16be5629dc754d83b1333c1fe2e6509f.bin

  • Size

    310KB

  • MD5

    68ba63b0e19350446fc003ca91670234

  • SHA1

    9e005f06fe98eccb731d94992542e5547cfcd37f

  • SHA256

    f27f5089d1ffcae39029ef86a93b884e16be5629dc754d83b1333c1fe2e6509f

  • SHA512

    43479cb78be12d0a4282dfa9d11dd50249c62e10463ae9bc7498c94d10268d31dd9ad7d3f71cc5a1973518f0cf0e207bb0e771d6dc4e8891a1f3cb65b68edbd0

  • SSDEEP

    6144:DLtfGfwH+l+ngvFEU/GwBT2dhP6VyUZ8GR/X8PyO7xsiC+J5:DkIH3CFGwyPsZn/XBO7izm5

  Score

  10^/10

  xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencetrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Checks if the Android device is rooted.

    evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Requests changing the default SMS application.

    collectionimpact

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3