Extracted

• • Target

    1e57614226f4e3f00c9d83ecd5f0db472b629f6c6945177e11a42c875a33f87c.bin

  • Size

    277KB

  • MD5

    1f17648b932eb426376931553b3c8084

  • SHA1

    40c15ad49b175c0fffdd5a928ad442f05e896ca0

  • SHA256

    1e57614226f4e3f00c9d83ecd5f0db472b629f6c6945177e11a42c875a33f87c

  • SHA512

    816910187bd606e17d59e5935ee255691ded3537cb9edd017d85c036fd3f4759dc92ee3b14315467b47d97e10368947ee05a4a6bb29cfa804c580bb2f044a00d

  • SSDEEP

    6144:AAecPHfgcJuTLDmT+Iqm0+b26KphuIVIiI6ggj6NFA2fvxMFhD:T0o+RmnbqdCyl+FA2fvxGD

  Score

  10^/10

  xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Checks if the Android device is rooted.

    evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Requests changing the default SMS application.

    collectionimpact

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3