xloader_apk | d9adfdd2908fe30eeecb5443787d33d2dc9c4fe5c201665058261c6330af8c98

Analysis

max time kernel
8s
max time network
68s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
21-12-2024 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a196666d4aaaa6ae0ba9e498ffd8f65c.apk
Size

296KB
MD5

a196666d4aaaa6ae0ba9e498ffd8f65c
SHA1

085835b10dcbe5117547ac597ce24f3dd3fd283f
SHA256

d9adfdd2908fe30eeecb5443787d33d2dc9c4fe5c201665058261c6330af8c98
SHA512

dbc965bdad00d35545a069d7723be8c6d3124644886de2313fb4117109f113d4d55d196fda0305f4ef9b5a8761fa4611928dd075bec3fc689fa76ac18e57e894
SSDEEP

6144:UOH3U0QhDuC1Wx1+lJW1vsPlEczJaUHPNyWY1NHXPfY+TDBxW:hXUaQa+ls1EPl11dYWkN3PA+Te

Score

10^/10

xloader_apk banker evasion infostealer trojan

Malware Config

Signatures

XLoader payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Xloader_apk family
xloader_apk

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.njyi.tvwb

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.njyi.tvwb/files/dex	4501	com.njyi.tvwb
/data/user/0/com.njyi.tvwb/files/dex	4501	com.njyi.tvwb

com.njyi.tvwb
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
PID:4501

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.njyi.tvwb/files/dex

Filesize
482KB

MD5
596227101999c7b6a2259f1bdd57997a

SHA1
81bc0f0e305bebfac09c06784f5ecf7a26b05f37

SHA256
bc2b4b4143615f87f5604b494ceae969b04051cc995e4d371fdeb3966b713344

SHA512
dbb13d983c7231acd5fff598584ac1206e362a5a2d90cedc51184208d7d119f077c8bf1885caa11d90b456a3ba73bd9b2ee99694d328e313f144047b7ba0c7ad

Download Submit