Extracted

• • Target

    5ee501d85a5e2bb52418d577bfae7e9e5e3113cb80a287b069c47294b256d0d2.bin

  • Size

    206KB

  • MD5

    c9287589b0f71a19d79da682e4f27039

  • SHA1

    c3dd565dab764c8f1405eeec495d9550cb8f6b73

  • SHA256

    5ee501d85a5e2bb52418d577bfae7e9e5e3113cb80a287b069c47294b256d0d2

  • SHA512

    321c2e62aae2f3ae83f2ca4a6c8b775329deed73e874e5fc0b63f3d8c05dfdf339056886962eae4a05a229bee5f1a3173c62eb2d9cc2f4f6f2d0522c080955c2

  • SSDEEP

    3072:wX+JH+roBoBKY7oupboIS0phUVCUDhBYMXasFYvXwvVQNPbfDBMipz6306sgONbN:wXW+rUY7bczKvFTDn16PsgONB7sQ3

  Score

  10^/10

  xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Checks if the Android device is rooted.

    evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Requests changing the default SMS application.

    collectionimpact
  behavioral1behavioral2behavioral3