Extracted

• • Target

    0cfe8fe1886f8e31921b612dedbe93bb5b292d308b7fb41839d9f4d76ade2c78.bin

  • Size

    309KB

  • MD5

    94eefcb0384f847c03e2993b98734991

  • SHA1

    04e9ee7185d38ff4b8866c2da8b2598cb753375d

  • SHA256

    0cfe8fe1886f8e31921b612dedbe93bb5b292d308b7fb41839d9f4d76ade2c78

  • SHA512

    bc4735f7158ac503ec4ee8f56cb3b62139e8104606371e81e0e18953d881c29be2ced1057f7d628591483e2f292806e5a642ea27896dc1235b3c3b7eea4b48d3

  • SSDEEP

    6144:fqVgL5SsFyXRosVhHn8xsKSyh8cWJ7uc2hWAnFXMemm1lnRKh:S61SFhosVhH8HSyycwzAn1lIh

  Score

  10^/10

  xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Checks if the Android device is rooted.

    evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Requests changing the default SMS application.

    collectionimpact
  behavioral1behavioral2behavioral3