xloader_apk | c633879feed6a15139a7756bc0da7c16ae18bb79cf527591a365cca1967d55ef

General

Target
c633879feed6a15139a7756bc0da7c16ae18bb79cf527591a365cca1967d55ef.bin
Size 212KB
Sample250102-12jada1jar
SHA256 c633879feed6a15139a7756bc0da7c16ae18bb79cf527591a365cca1967d55ef
MD5 2e6b55bfa47e6cd5edabfd1ae52809be
SHA1 926aaac5b3b1219302f5ea3af0cb7b5ef8c69153
SHA512 68aaaef0817385e22a9c841b10bc73f51c4a15aaa866d69657d5af499dcc00605526daf0dd5a101fa3fba618684822cc22b8e39557cdcd1126330b8f97d15ba9
SSDEEP 3072:ahxu0hx1prsAjat8z5aBZTqg1NW33BBFkMIelBNo+TFac9djxIK4v:azu0XJyUaBZTqgXW3jFkMIePhac9dEv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  c633879feed6a15139a7756bc0da7c16ae18bb79cf527591a365cca1967d55ef.bin
- Size 212KB
- SHA256 c633879feed6a15139a7756bc0da7c16ae18bb79cf527591a365cca1967d55ef
- MD5 2e6b55bfa47e6cd5edabfd1ae52809be
- SHA1 926aaac5b3b1219302f5ea3af0cb7b5ef8c69153
- SHA512 68aaaef0817385e22a9c841b10bc73f51c4a15aaa866d69657d5af499dcc00605526daf0dd5a101fa3fba618684822cc22b8e39557cdcd1126330b8f97d15ba9
- SSDEEP 3072:ahxu0hx1prsAjat8z5aBZTqg1NW33BBFkMIelBNo+TFac9djxIK4v:azu0XJyUaBZTqgXW3jFkMIePhac9dEv
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xloader_apk banker collection discovery evasion infostealer persistence stealth trojan
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Xloader_apk family
  xloader_apk
- Checks if the Android device is rooted.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1