xloader_apk | b61c5e7d9f711b6100797d8fd1dc7f5cf653f0ce8d769cf827ae7917c7fb7879

General

Target

b61c5e7d9f711b6100797d8fd1dc7f5cf653f0ce8d769cf827ae7917c7fb7879.bin
Size

218KB
Sample

250208-1x5yksxmdn
MD5

65c97fc92237f3fb1fa211c955772e39
SHA1

d809d037b6accbf55120538bbf4c61076938d990
SHA256

b61c5e7d9f711b6100797d8fd1dc7f5cf653f0ce8d769cf827ae7917c7fb7879
SHA512

0eecfebc0d505491df866b8de746b6ff93e729dccd9115ac93e5c2a96116f36d79291db1af52b37184b825e7e72de5992f37a9a5e9753ff33548951546b5c9e0
SSDEEP

6144:j4qIqgSDZEdyTA1HkeI8oW5FCmlGhrRQDocE:pIqv/MVkeJ5cmiAocE

Score

10^/10

Malware Config

Extracted

Family

xloader_apk

C2

https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic

Attributes

user_agent
Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

Targets

- Target
  
  b61c5e7d9f711b6100797d8fd1dc7f5cf653f0ce8d769cf827ae7917c7fb7879.bin
- Size
  
  218KB
- MD5
  
  65c97fc92237f3fb1fa211c955772e39
- SHA1
  
  d809d037b6accbf55120538bbf4c61076938d990
- SHA256
  
  b61c5e7d9f711b6100797d8fd1dc7f5cf653f0ce8d769cf827ae7917c7fb7879
- SHA512
  
  0eecfebc0d505491df866b8de746b6ff93e729dccd9115ac93e5c2a96116f36d79291db1af52b37184b825e7e72de5992f37a9a5e9753ff33548951546b5c9e0
- SSDEEP
  
  6144:j4qIqgSDZEdyTA1HkeI8oW5FCmlGhrRQDocE:pIqv/MVkeJ5cmiAocE
Score

10^/10

xloader_apk banker collection defense_evasion discovery evasion impact infostealer persistence stealth trojan
- XLoader payload
- XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Xloader_apk family
  xloader_apk
- Checks if the Android device is rooted.
  defense_evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Requests changing the default SMS application.
  collection impact
behavioral1 behavioral2 behavioral3