Extracted

• • Target
    f94837aa4f9e2d7bd4da28d31151181b05d37f2f2343993d639ddef59f5c4261.bin
  • Size 212KB
  • SHA256 f94837aa4f9e2d7bd4da28d31151181b05d37f2f2343993d639ddef59f5c4261
  • MD5 45f5b32ea95b4dd9f09fecdc75f53a9b
  • SHA1 c88e2fe3318e20e6bc2fcaf5cf3f3824b998362e
  • SHA512 acdea4f25dccd1bcfbb611b834daeaa02a3766876143669730ea4231973511a81148dd2ee6724ec7af801f608dfe1878cd25d394874aa76fd6f96e49c946104d
  • SSDEEP 6144:VMDJr0jKGIPdQ2ORIJvlEsHpw/2e2pwwx:VMx0/YdNORYllU2r
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Xloader_apk family

    xloader_apk

  • Checks if the Android device is rooted.

    evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries account information for other applications stored on the device

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1