Extracted

Extracted

• • Target

    9c4999a9ccc9ae3163fed311754ec04a5998e3a2110d6b729d2331b3c843ed7c.bin

  • Size

    164KB

  • MD5

    1516c32ee0d9686fccc5b2f427002e0b

  • SHA1

    13cece68c92d27a7678463b860a3ecc6b9404dec

  • SHA256

    9c4999a9ccc9ae3163fed311754ec04a5998e3a2110d6b729d2331b3c843ed7c

  • SHA512

    e6b71c44be7f58cbde42320191e655f05428bc371ed00ccadde0524c358f4074b10bb409434cf1dad4ec49bab658c7fe9d5fd92fd832d4a48dfaff2351c0093c

  • SSDEEP

    3072:GUWPzjquVysC+A5+CBljscfhNY5bpfXC03ZOrurjdf2kmFmov6HzNsPvQ545h:GPLWieBJffhNY5bpbZO6rwkxjHzNs3Qe

  Score

  10^/10

  xloader_apkbankercollectiondefense_evasiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • XLoader payload

  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Xloader_apk family

    xloader_apk

  • Checks if the Android device is rooted.

    defense_evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries account information for other applications stored on the device

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1