General
-
Target
6f8d64540b43956d914d467163687b83361109c175dbd7458b9264b4b5f3ab80.bin
-
Size
412KB
-
Sample
240803-13mdesxbmj
-
MD5
c30f922acbd8abd1b9da53b42d995ffe
-
SHA1
2931af2ccb7e43f508d6318aeb1b4b87a1e98d52
-
SHA256
6f8d64540b43956d914d467163687b83361109c175dbd7458b9264b4b5f3ab80
-
SHA512
9e502c02b3ce13d6a214bb58aaf31d3981a095a6042e96dc44d149d0f5583ce556ba964b0574838a2d45c2fa89eb715bef5b69a457d5764f9e8e7125ca07bd59
-
SSDEEP
6144:NaD1jl4tiRbItksmtdByQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuWH:q1p4tilIohDNUHiiQDhu0vUEbqmEYx9H
Static task
static1
Behavioral task
behavioral1
Sample
6f8d64540b43956d914d467163687b83361109c175dbd7458b9264b4b5f3ab80.apk
Resource
android-x86-arm-20240624-en
Malware Config
Extracted
xloader_apk
http://91.204.227.50:28899
Targets
-
-
Target
6f8d64540b43956d914d467163687b83361109c175dbd7458b9264b4b5f3ab80.bin
-
Size
412KB
-
MD5
c30f922acbd8abd1b9da53b42d995ffe
-
SHA1
2931af2ccb7e43f508d6318aeb1b4b87a1e98d52
-
SHA256
6f8d64540b43956d914d467163687b83361109c175dbd7458b9264b4b5f3ab80
-
SHA512
9e502c02b3ce13d6a214bb58aaf31d3981a095a6042e96dc44d149d0f5583ce556ba964b0574838a2d45c2fa89eb715bef5b69a457d5764f9e8e7125ca07bd59
-
SSDEEP
6144:NaD1jl4tiRbItksmtdByQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuWH:q1p4tilIohDNUHiiQDhu0vUEbqmEYx9H
-
XLoader payload
-
Checks if the Android device is rooted.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the MMS message.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-