xloader_apk | be5bd169d4950913786029686376143cd836e24019eb845521eecbdd5862123e | Triage

Sharing

General

Target

be5bd169d4950913786029686376143cd836e24019eb845521eecbdd5862123e.bin
Size

207KB
Sample

240807-11zwqsydjd
MD5

04d95986c1ef12cca9c31dc2668056fb
SHA1

eb325e6bbbd70f266234ad8cdb279546009437d1
SHA256

be5bd169d4950913786029686376143cd836e24019eb845521eecbdd5862123e
SHA512

105a9dea2c9956ca0187c2651625138595cde36474f19a8a90e21229e3b467ba566ff67276cf9d75e8264900ee825eb7d463f742d5c90bab140b82a4bd65e3fe
SSDEEP

6144:tMN9FFN4LKFUhzF17N0XGo+oruJhX61Ln3nm8lhle2gfA8:tMN994LKyhXZ0XGoBqLSm8lhle2l8

Score

10^/10

xloader_apk android banker collection discovery evasion impact infostealer persistence trojan

Malware Config

Targets

- Target
  
  be5bd169d4950913786029686376143cd836e24019eb845521eecbdd5862123e.bin
- Size
  
  207KB
- MD5
  
  04d95986c1ef12cca9c31dc2668056fb
- SHA1
  
  eb325e6bbbd70f266234ad8cdb279546009437d1
- SHA256
  
  be5bd169d4950913786029686376143cd836e24019eb845521eecbdd5862123e
- SHA512
  
  105a9dea2c9956ca0187c2651625138595cde36474f19a8a90e21229e3b467ba566ff67276cf9d75e8264900ee825eb7d463f742d5c90bab140b82a4bd65e3fe
- SSDEEP
  
  6144:tMN9FFN4LKFUhzF17N0XGo+oruJhX61Ln3nm8lhle2gfA8:tMN994LKyhXZ0XGoBqLSm8lhle2l8
Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence trojan
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Checks if the Android device is rooted.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Requests changing the default SMS application.
  collection impact
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Credential Access

Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Protected User Data

SMS Messages

Command and Control

Exfiltration

Impact

SMS Control

Tasks

static1

behavioral1

xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencetrojan