Overview

overview

10

Static

static

6

5dbb0b9087...52.apk

android-9-x86

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5dbb0b90875c73558d20bbe97ac397287a39b7f4da0abc62299957d5927adc52.bin

  • Size

    444KB

  • Sample

    240803-1395gsxbqn

  • MD5

    717617d613bad48442b153c65304bed8

  • SHA1

    0451585f5cbfd4fea12059550347e57b7658ff66

  • SHA256

    5dbb0b90875c73558d20bbe97ac397287a39b7f4da0abc62299957d5927adc52

  • SHA512

    c0d15d198d472a06321ad326ee284aa7f41c49afdf221c9a1f36fe060ee61c6db95c4c95f7c621be139c66062d03b0300319c1081c3ae0ecabb352b4884ada86

  • SSDEEP

    12288:N+z+wb76eqEia3tJMbodkRjHCtV9IhY4P433y3r76BPS0LZ18TfjwFL:N+PKeL+boeRjHcV9IhdY3sr76BPS5O

Score
10/10
xloader_apkandroidbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Targets

    • Target

      5dbb0b90875c73558d20bbe97ac397287a39b7f4da0abc62299957d5927adc52.bin

    • Size

      444KB

    • MD5

      717617d613bad48442b153c65304bed8

    • SHA1

      0451585f5cbfd4fea12059550347e57b7658ff66

    • SHA256

      5dbb0b90875c73558d20bbe97ac397287a39b7f4da0abc62299957d5927adc52

    • SHA512

      c0d15d198d472a06321ad326ee284aa7f41c49afdf221c9a1f36fe060ee61c6db95c4c95f7c621be139c66062d03b0300319c1081c3ae0ecabb352b4884ada86

    • SSDEEP

      12288:N+z+wb76eqEia3tJMbodkRjHCtV9IhY4P433y3r76BPS0LZ18TfjwFL:N+PKeL+boeRjHcV9IhdY3sr76BPS5O

    Score
    10/10
    xloader_apkbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

      trojaninfostealerbankerxloader_apk

    • Checks if the Android device is rooted.

      evasion

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Queries the phone number (MSISDN for GSM devices)

      discovery

    • Reads the content of the MMS message.

      collection

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence
    behavioral1

MITRE ATT&CK Mobile v15

Tasks