General
-
Target
aab52b6a9ba660e3d2a35a239e5b4838ff4f0bc85d3eba37acc9d7b29365c0e7.bin
-
Size
408KB
-
Sample
240803-13fkwa1gnc
-
MD5
878c01187236e490fc91f31695b5f068
-
SHA1
f6d45fc015e37fe651306ed3554cd3d35a52d569
-
SHA256
aab52b6a9ba660e3d2a35a239e5b4838ff4f0bc85d3eba37acc9d7b29365c0e7
-
SHA512
2330cf298217d31257041a604f8f991626623d68519aec1e1ed1d48f6519a72ece6e8669f92aa3e9dbba1a68bc88f13421b04ef8d6c96c90403e4888dc9adc76
-
SSDEEP
6144:pXyQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuP6lOtSaRB9awoa67Wt2pi3:lDNUHiiQDhu0vUEbqmEYxu7B9awozBM
Static task
static1
Behavioral task
behavioral1
Sample
aab52b6a9ba660e3d2a35a239e5b4838ff4f0bc85d3eba37acc9d7b29365c0e7.apk
Resource
android-x86-arm-20240624-en
Malware Config
Extracted
xloader_apk
http://91.204.227.50:28899
Targets
-
-
Target
aab52b6a9ba660e3d2a35a239e5b4838ff4f0bc85d3eba37acc9d7b29365c0e7.bin
-
Size
408KB
-
MD5
878c01187236e490fc91f31695b5f068
-
SHA1
f6d45fc015e37fe651306ed3554cd3d35a52d569
-
SHA256
aab52b6a9ba660e3d2a35a239e5b4838ff4f0bc85d3eba37acc9d7b29365c0e7
-
SHA512
2330cf298217d31257041a604f8f991626623d68519aec1e1ed1d48f6519a72ece6e8669f92aa3e9dbba1a68bc88f13421b04ef8d6c96c90403e4888dc9adc76
-
SSDEEP
6144:pXyQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuP6lOtSaRB9awoa67Wt2pi3:lDNUHiiQDhu0vUEbqmEYxu7B9awozBM
-
XLoader payload
-
Checks if the Android device is rooted.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the MMS message.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-