xloader_apk | dbe67fe02530648be1ea803f1279cf3f67a02cdbd8a72f661f961638c1cd7646

General

Target

dbe67fe02530648be1ea803f1279cf3f67a02cdbd8a72f661f961638c1cd7646.bin
Size

308KB
Sample

250105-1z1fwazkhl
MD5

848bd103e49e899fb330fda3ffa46e1e
SHA1

dc97300b6203b75f3d674f051c777540b34618fa
SHA256

dbe67fe02530648be1ea803f1279cf3f67a02cdbd8a72f661f961638c1cd7646
SHA512

4ecd7632e95a1cfbb80e81dce7fe30d33f3af0f2de3cd902b03ef5ca71720eb96eab30d1cdaad1e57c85e04908cb35dcb8a2a8c1de3b12a0084f598482551e3f
SSDEEP

6144:9sONyeKf/SNBee3aeJXeqCKYtPVwmqNscZlCbeVyxCeufZ:9zxKf/STeeqe0KY5qKxh+R

Score

10^/10

Malware Config

Extracted

Family

xloader_apk

C2

http://1.171.162.250:33669/user_info_uploader

https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic

Attributes

user_agent
Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

Targets

- Target
  
  dbe67fe02530648be1ea803f1279cf3f67a02cdbd8a72f661f961638c1cd7646.bin
- Size
  
  308KB
- MD5
  
  848bd103e49e899fb330fda3ffa46e1e
- SHA1
  
  dc97300b6203b75f3d674f051c777540b34618fa
- SHA256
  
  dbe67fe02530648be1ea803f1279cf3f67a02cdbd8a72f661f961638c1cd7646
- SHA512
  
  4ecd7632e95a1cfbb80e81dce7fe30d33f3af0f2de3cd902b03ef5ca71720eb96eab30d1cdaad1e57c85e04908cb35dcb8a2a8c1de3b12a0084f598482551e3f
- SSDEEP
  
  6144:9sONyeKf/SNBee3aeJXeqCKYtPVwmqNscZlCbeVyxCeufZ:9zxKf/STeeqe0KY5qKxh+R
Score

10^/10

xloader_apk banker collection defense_evasion discovery evasion impact infostealer persistence stealth trojan
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Xloader_apk family
  xloader_apk
- Checks if the Android device is rooted.
  defense_evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Requests changing the default SMS application.
  collection impact
behavioral1 behavioral2 behavioral3