Extracted

• • Target

    cd955236f013c774e05fca9d14154c9a218b481198e16aaaadf22e75ea30cba7.bin

  • Size

    205KB

  • MD5

    d0ef026e709f9a967684f10255d807b0

  • SHA1

    563aa516de64e6639542ae2d60882a35d349b7d7

  • SHA256

    cd955236f013c774e05fca9d14154c9a218b481198e16aaaadf22e75ea30cba7

  • SHA512

    1734c9384c9720c120f8902827cb9704d6887f6656507f7e55747b77ec99e51ae21ec381359a3357b6a96bd2334725c020d660011942eda6ed52628d154bb48f

  • SSDEEP

    3072:RN2UgDG4K9Wzo2SZ1feBCUJm36PwfrxwEsGR86xETDKm50Ma1TGloNZoj6Aoa5a9:RkUgRJBJJmXdwEe6xEKGaQloNZohoV9

  Score

  10^/10

  xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Checks if the Android device is rooted.

    evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Requests changing the default SMS application.

    collectionimpact
  behavioral1behavioral2behavioral3