Extracted

• • Target

    a7723af4590037b5cd8eec93295af619612676de6b919df155ed875cf12b7196.bin

  • Size

    302KB

  • MD5

    718e266dbdef1184f91b4c7108c2360f

  • SHA1

    54cbcdec280df079e1920522e02707f8aefe83ac

  • SHA256

    a7723af4590037b5cd8eec93295af619612676de6b919df155ed875cf12b7196

  • SHA512

    aca300aec752ec8c5d490d509013b26b6718daaee0b67e9e2cf376cbac6b3ce5a0a9c5763d88462b4309f5bf5b522b40018a68be9540c5ecf9467f6cfc1b367e

  • SSDEEP

    6144:EuTlBiMQRYwvDnJ7LJXh1DiARNy2zabLbSUUhulCMX6R9JAvfy13J8kw:NltQxHbD/PAHmXhuJX6R9AeU

  Score

  10^/10

  xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Checks if the Android device is rooted.

    evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Requests changing the default SMS application.

    collectionimpact
  behavioral1behavioral2behavioral3