xloader_apk | 0d21d8d55b431ed1cc397e683e47c8284d9cd386a4374edeb7823bb86126c873 | Triage

Sharing

General

Target

0d21d8d55b431ed1cc397e683e47c8284d9cd386a4374edeb7823bb86126c873.bin
Size

390KB
Sample

240809-18fstswdmf
MD5

6f19fcc4cb546099adf00a0048998674
SHA1

78662f798ca80226fd5f2214b1c4ee3ad35c90c1
SHA256

0d21d8d55b431ed1cc397e683e47c8284d9cd386a4374edeb7823bb86126c873
SHA512

3a6378a7ae001ef9e474a3345031f38fcac629c69f4435629d45180c0dc28f0909e92395acbc840ff39f7450e8cfc5e34ff43e31c7f11f2c8f2a39181b0b705b
SSDEEP

12288:511sUNpMt8iN+ubg6G9hgQyLDSp4hDygsaimSXVN:5Rzji8ubDWhgDM4hbTST

Score

10^/10

xloader_apk android banker collection discovery evasion infostealer persistence stealth trojan

Malware Config

Targets

- Target
  
  0d21d8d55b431ed1cc397e683e47c8284d9cd386a4374edeb7823bb86126c873.bin
- Size
  
  390KB
- MD5
  
  6f19fcc4cb546099adf00a0048998674
- SHA1
  
  78662f798ca80226fd5f2214b1c4ee3ad35c90c1
- SHA256
  
  0d21d8d55b431ed1cc397e683e47c8284d9cd386a4374edeb7823bb86126c873
- SHA512
  
  3a6378a7ae001ef9e474a3345031f38fcac629c69f4435629d45180c0dc28f0909e92395acbc840ff39f7450e8cfc5e34ff43e31c7f11f2c8f2a39181b0b705b
- SSDEEP
  
  12288:511sUNpMt8iN+ubg6G9hgQyLDSp4hDygsaimSXVN:5Rzji8ubDWhgDM4hbTST
Score

10^/10

xloader_apk banker collection discovery evasion infostealer persistence stealth trojan
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Checks if the Android device is rooted.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Hide Artifacts

Suppress Application Icon

Credential Access

Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Protected User Data

SMS Messages

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xloader_apkbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

behavioral2

xloader_apkbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

behavioral3

xloader_apkbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan