xloader_apk | b5977505893f97028bffb578de14595f3346f1d75fc894ff8cb9880f74ac31c5

General

Target
sagawa.apk
Size 2.4MB
Sample260528-plbptaft5n
SHA256 b5977505893f97028bffb578de14595f3346f1d75fc894ff8cb9880f74ac31c5
MD5 397a45663d8fb7cc20584784d223f80a
SHA1 0c6aa0b2c14c022b23c75765ae793d56938a3e72
SHA512 8ec1b319fcdf1a87b1808b6e07ef9d559a1855f3ffc489d01b006292e2569afd7ee16fa18cd13cd465d6bd789285709f963d775feb3b6b539a7d8b38e1e10703
SSDEEP 49152:SpD1Lpjz39+WtD8SoARZMkuTjxMxHkJF25UlN8+w8QaQAq6j+77S:SpFpvtFaSoA6HkeU5Qqx77S
TLSH
T170C533E5A4300F62E8D7B174C4EA4F92C4C4A99107428C9ECFE98C9DB7A77B4F975920
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  sagawa.apk
- Size 2.4MB
- SHA256 b5977505893f97028bffb578de14595f3346f1d75fc894ff8cb9880f74ac31c5
- MD5 397a45663d8fb7cc20584784d223f80a
- SHA1 0c6aa0b2c14c022b23c75765ae793d56938a3e72
- SHA512 8ec1b319fcdf1a87b1808b6e07ef9d559a1855f3ffc489d01b006292e2569afd7ee16fa18cd13cd465d6bd789285709f963d775feb3b6b539a7d8b38e1e10703
- SSDEEP 49152:SpD1Lpjz39+WtD8SoARZMkuTjxMxHkJF25UlN8+w8QaQAq6j+77S:SpFpvtFaSoA6HkeU5Qqx77S
- TLSH
  T170C533E5A4300F62E8D7B174C4EA4F92C4C4A99107428C9ECFE98C9DB7A77B4F975920
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection defense_evasion discovery evasion xloader_apk impact infostealer persistence trojan
- Family: XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
- Requests dangerous framework permissions
behavioral1