Overview

overview

10

Static

static

6

90b1334759...c8.apk

android-13-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90b13347594f8365eddd3098c85678b0e441fe3b8ba23dcd3b4e01860dc3e7c8.bin

  • Size

    209KB

  • Sample

    241107-124ajszamn

  • MD5

    09001fa6e8bc152d7e76a1704cb3242e

  • SHA1

    11f05f17b64d5171f5b84052965b403514c0fbc3

  • SHA256

    90b13347594f8365eddd3098c85678b0e441fe3b8ba23dcd3b4e01860dc3e7c8

  • SHA512

    1d211e8028262ae2f41d69c693ae931b919ce5a6a1a2fce3de6bea5f09b3c46cb9ecc0523d6ae57974247cf5f4e708e204e865894d0955f0194dbb67e6009b86

  • SSDEEP

    6144:OrLsdjVXITeLW1Gff95MQTN9W+2NXKF6fraw:kLGVXITeLWAfHniN6FKraw

Score
10/10
xloader_apkandroidbankercollectiondiscoveryevasionimpactinfostealerpersistencetrojan

Malware Config

Targets

    • Target

      90b13347594f8365eddd3098c85678b0e441fe3b8ba23dcd3b4e01860dc3e7c8.bin

    • Size

      209KB

    • MD5

      09001fa6e8bc152d7e76a1704cb3242e

    • SHA1

      11f05f17b64d5171f5b84052965b403514c0fbc3

    • SHA256

      90b13347594f8365eddd3098c85678b0e441fe3b8ba23dcd3b4e01860dc3e7c8

    • SHA512

      1d211e8028262ae2f41d69c693ae931b919ce5a6a1a2fce3de6bea5f09b3c46cb9ecc0523d6ae57974247cf5f4e708e204e865894d0955f0194dbb67e6009b86

    • SSDEEP

      6144:OrLsdjVXITeLW1Gff95MQTN9W+2NXKF6fraw:kLGVXITeLWAfHniN6FKraw

    Score
    10/10
    xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencetrojan

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

      trojaninfostealerbankerxloader_apk

    • Xloader_apk family

      xloader_apk

    • Checks if the Android device is rooted.

      evasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Queries the phone number (MSISDN for GSM devices)

      discovery

    • Reads the content of the MMS message.

      collection

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Requests changing the default SMS application.

      collectionimpact
    behavioral1

MITRE ATT&CK Mobile v15

Tasks