xloader_apk | d9adfdd2908fe30eeecb5443787d33d2dc9c4fe5c201665058261c6330af8c98

Analysis

max time kernel
8s
max time network
68s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
21/12/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a196666d4aaaa6ae0ba9e498ffd8f65c.apk
Size 296KB
Sample241221-vfr3hatldv
SHA256 d9adfdd2908fe30eeecb5443787d33d2dc9c4fe5c201665058261c6330af8c98
MD5 a196666d4aaaa6ae0ba9e498ffd8f65c
SHA1 085835b10dcbe5117547ac597ce24f3dd3fd283f
SHA512 dbc965bdad00d35545a069d7723be8c6d3124644886de2313fb4117109f113d4d55d196fda0305f4ef9b5a8761fa4611928dd075bec3fc689fa76ac18e57e894
SSDEEP 6144:UOH3U0QhDuC1Wx1+lJW1vsPlEczJaUHPNyWY1NHXPfY+TDBxW:hXUaQa+ls1EPl11dYWkN3PA+Te
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xloader_apk banker evasion infostealer trojan

Malware Config

Signatures

XLoader payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Xloader_apk family
xloader_apk

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.njyi.tvwb

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.njyi.tvwb/files/dex	4501	com.njyi.tvwb
/data/user/0/com.njyi.tvwb/files/dex	4501	com.njyi.tvwb

com.njyi.tvwb
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
PID:4501

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dex

Path /data/user/0/com.njyi.tvwb/files/dex
Size 482KB
SHA256 bc2b4b4143615f87f5604b494ceae969b04051cc995e4d371fdeb3966b713344
MD5 596227101999c7b6a2259f1bdd57997a
SHA1 81bc0f0e305bebfac09c06784f5ecf7a26b05f37
SHA512 dbb13d983c7231acd5fff598584ac1206e362a5a2d90cedc51184208d7d119f077c8bf1885caa11d90b456a3ba73bd9b2ee99694d328e313f144047b7ba0c7ad
SSDEEP 12288:Ivlq5LtFKCG5xpMbis1rHcmWMWMA8m/CbEcaLS8m/CbEcaLChwFpJv:klq5LtFKCG5xpMb9Ru58m/CbEcaLS8md
MD5 SHA1 SHA512 SSDEEP

Submit Download