xloader_apk | 83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff

General

Target

83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff.bin
Size

305KB
Sample

250105-1z1rmszkhn
MD5

54b1a1a9e2ba31c5a14185d1da28b84c
SHA1

33a1be6f4459b84f2719c76ab15cb99f7cc8e783
SHA256

83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff
SHA512

c10c9181bcedccc8e66ceaa33c619543c97b253c7e9cf03296347465f942e4259102a7ce1932316d17e1c997734199c77b96cf3ab138f0b730f25a920703d59d
SSDEEP

6144:wsONyeKf/SNBee3aeJXeqCKYtPVwmqNscZlCbeVyxCdxCa:wzxKf/STeeqe0KY5qKxhkB

Score

10^/10

Malware Config

Extracted

Family

xloader_apk

C2

http://1.171.162.250:33669/user_info_uploader

https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic

Attributes

user_agent
Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

Targets

- Target
  
  83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff.bin
- Size
  
  305KB
- MD5
  
  54b1a1a9e2ba31c5a14185d1da28b84c
- SHA1
  
  33a1be6f4459b84f2719c76ab15cb99f7cc8e783
- SHA256
  
  83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff
- SHA512
  
  c10c9181bcedccc8e66ceaa33c619543c97b253c7e9cf03296347465f942e4259102a7ce1932316d17e1c997734199c77b96cf3ab138f0b730f25a920703d59d
- SSDEEP
  
  6144:wsONyeKf/SNBee3aeJXeqCKYtPVwmqNscZlCbeVyxCdxCa:wzxKf/STeeqe0KY5qKxhkB
Score

10^/10

xloader_apk banker collection defense_evasion discovery evasion impact infostealer persistence stealth trojan
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Xloader_apk family
  xloader_apk
- Checks if the Android device is rooted.
  defense_evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Requests changing the default SMS application.
  collection impact
behavioral1 behavioral2 behavioral3