General
-
Target
1afa50accebc1c4d1a363b58c7abfe7480cdd91b81e4f5fbe93822574c0bb392.bin
-
Size
289KB
-
Sample
241007-2adfgszdpf
-
MD5
ea50fdeff6cf2061c231df73684d1a13
-
SHA1
fb7c617a50581f3bf9798ec3adf37ab2e8fc3b3f
-
SHA256
1afa50accebc1c4d1a363b58c7abfe7480cdd91b81e4f5fbe93822574c0bb392
-
SHA512
463785c6d7435fd7c2a630e19f7b4a9ea74189e4b25c8e7ef5a784fc149ee4f9dea9f439114dc752e0dd0fbaea587c5d213a97f715804b461d4eecb26a887882
-
SSDEEP
6144:YeKBuxMUhEI6hrm51SPv28yOyd/jn0KIGSEaiM+seXf6x7P:H3veZAHSP+AyRj0Kq+ssMb
Static task
static1
Behavioral task
behavioral1
Sample
1afa50accebc1c4d1a363b58c7abfe7480cdd91b81e4f5fbe93822574c0bb392.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
1afa50accebc1c4d1a363b58c7abfe7480cdd91b81e4f5fbe93822574c0bb392.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
1afa50accebc1c4d1a363b58c7abfe7480cdd91b81e4f5fbe93822574c0bb392.apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Targets
-
-
Target
1afa50accebc1c4d1a363b58c7abfe7480cdd91b81e4f5fbe93822574c0bb392.bin
-
Size
289KB
-
MD5
ea50fdeff6cf2061c231df73684d1a13
-
SHA1
fb7c617a50581f3bf9798ec3adf37ab2e8fc3b3f
-
SHA256
1afa50accebc1c4d1a363b58c7abfe7480cdd91b81e4f5fbe93822574c0bb392
-
SHA512
463785c6d7435fd7c2a630e19f7b4a9ea74189e4b25c8e7ef5a784fc149ee4f9dea9f439114dc752e0dd0fbaea587c5d213a97f715804b461d4eecb26a887882
-
SSDEEP
6144:YeKBuxMUhEI6hrm51SPv28yOyd/jn0KIGSEaiM+seXf6x7P:H3veZAHSP+AyRj0Kq+ssMb
-
XLoader payload
-
Checks if the Android device is rooted.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the MMS message.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests changing the default SMS application.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1