Extracted

• • Target

    ea2c1aaa3a698249c101149494fd761a89d8c5a723fe316619c6011c151ea8d0.bin

  • Size

    212KB

  • MD5

    76c4709d3d96a454eae0aba83cff6be4

  • SHA1

    400c51c76644d75479e3df38600c376b77b82f36

  • SHA256

    ea2c1aaa3a698249c101149494fd761a89d8c5a723fe316619c6011c151ea8d0

  • SHA512

    3f1bb9ab672ca899424daac2275ebb3e2266ec013cf63ea75df21c57a962daa6b1d9d037589d9c3d4e88f31927b7b11cc82ee3e28a1085fc10624ecfb217aeb7

  • SSDEEP

    3072:FzAbNrtfoj+PdiR4Ytlebmfq4F63koAt5h3miD652qbZ6effD8SIfA0Y:KrtLhY73v60vh2iD65246e31IfAd

  Score

  10^/10

  xloader_apkbankercollectiondefense_evasiondiscoveryevasioninfostealerpersistencestealthtrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Xloader_apk family

    xloader_apk

  • Checks if the Android device is rooted.

    defense_evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1