xloader_apk | 48548273d7330e6c8a4e483ac6c6c1a62ba71a83d93f1fb91ff0daf2f10a6a27

General

Target

48548273d7330e6c8a4e483ac6c6c1a62ba71a83d93f1fb91ff0daf2f10a6a27.bin
Size

207KB
Sample

240807-111g9sydjg
MD5

8bd502991cafe448c5fd4694fbea32b3
SHA1

c371b212be1f9fac37d3730c7ce323a4e7f807a8
SHA256

48548273d7330e6c8a4e483ac6c6c1a62ba71a83d93f1fb91ff0daf2f10a6a27
SHA512

6f28d1772f95ad58e4077f8773efc59ceefedcba84409ecd245b3058ed0b2784420a1559dd4ccb25ced2ae9d7b2bc90213e8e9ae5de7dd58bf90d879fea6cbeb
SSDEEP

6144:OZguiKBNNrgdUhzF17N0XGo+oruJhX61Ln3nm8lhle2gdFx+3:OuEBrsKhXZ0XGoBqLSm8lhle2UFx+3

Score

10^/10

Malware Config

Targets

- Target
  
  48548273d7330e6c8a4e483ac6c6c1a62ba71a83d93f1fb91ff0daf2f10a6a27.bin
- Size
  
  207KB
- MD5
  
  8bd502991cafe448c5fd4694fbea32b3
- SHA1
  
  c371b212be1f9fac37d3730c7ce323a4e7f807a8
- SHA256
  
  48548273d7330e6c8a4e483ac6c6c1a62ba71a83d93f1fb91ff0daf2f10a6a27
- SHA512
  
  6f28d1772f95ad58e4077f8773efc59ceefedcba84409ecd245b3058ed0b2784420a1559dd4ccb25ced2ae9d7b2bc90213e8e9ae5de7dd58bf90d879fea6cbeb
- SSDEEP
  
  6144:OZguiKBNNrgdUhzF17N0XGo+oruJhX61Ln3nm8lhle2gdFx+3:OuEBrsKhXZ0XGoBqLSm8lhle2UFx+3
Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Checks if the Android device is rooted.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Requests changing the default SMS application.
  collection impact
behavioral1