Extracted

• • Target

    23cbf8759be00bcbbc2921da0ad8e2a7daeaba4b3931122a9d31beea5b703f88.bin

  • Size

    302KB

  • MD5

    1f619b2c41b1a9b61f404a1cb7a332a8

  • SHA1

    436b0fb961eb398499674df3d46083a9f026bd94

  • SHA256

    23cbf8759be00bcbbc2921da0ad8e2a7daeaba4b3931122a9d31beea5b703f88

  • SHA512

    afc62a9dc6f8f66f10cdac4df174cf1ade3b84063507d321e40fb6235396bd610a7ea78ddf25cbeb30a3801f0fee3c6668874805237c8e1dcf917555fb6335ae

  • SSDEEP

    6144:5qsilgEE0tH79LnHeJmoV6vI0MvyTy9V0WDnKGE6Es2U5CEsmkj4eXwPkm:5ChLHA0Q052KH6ES5CEsmknXwPkm

  Score

  10^/10

  xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Checks if the Android device is rooted.

    evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Requests changing the default SMS application.

    collectionimpact
  behavioral1behavioral2behavioral3