xloader_apk | 002af4ceac800f6a2b5c4710c09192b1d940d356bb6c86ee43b6cbe2725276aa

General

Target
sagawa.zip
Size 2.4MB
Sample260601-pshrpses4q
SHA256 002af4ceac800f6a2b5c4710c09192b1d940d356bb6c86ee43b6cbe2725276aa
MD5 c28a7d5146b543b8b7836268aec724ab
SHA1 ae8e3531b2d50c758d3643d1d6633da751009727
SHA512 5d8eb1cb9e9a3fb852620dad33f7bddab7222d824f3dbd3671d35dfc3b2c087464e780eebeb11c3459688c7ec8756378ba747d9fdfb17dde7ee4a964946c7335
SSDEEP 49152:AiwlkTeWVKv6cjsMHHDRZo2gf9sCZ7lcpHHHTUxgUAejiIuBYhdVE:jwlkTeIKSD6F69ZlcxT6iFYni
TLSH
T16FC533034DA814EDD7FC424A65642721E374DB8CCEAC5C196BC830A7DE2982DBEF59E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  sagawa.zip
- Size 2.4MB
- SHA256 002af4ceac800f6a2b5c4710c09192b1d940d356bb6c86ee43b6cbe2725276aa
- MD5 c28a7d5146b543b8b7836268aec724ab
- SHA1 ae8e3531b2d50c758d3643d1d6633da751009727
- SHA512 5d8eb1cb9e9a3fb852620dad33f7bddab7222d824f3dbd3671d35dfc3b2c087464e780eebeb11c3459688c7ec8756378ba747d9fdfb17dde7ee4a964946c7335
- SSDEEP 49152:AiwlkTeWVKv6cjsMHHDRZo2gf9sCZ7lcpHHHTUxgUAejiIuBYhdVE:jwlkTeIKSD6F69ZlcxT6iFYni
- TLSH
  T16FC533034DA814EDD7FC424A65642721E374DB8CCEAC5C196BC830A7DE2982DBEF59E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  248cb5b76ed1a5049b3d7aafd24ad356c7a11e8eff17854971078f291961af33
- Size 2.4MB
- SHA256 248cb5b76ed1a5049b3d7aafd24ad356c7a11e8eff17854971078f291961af33
- MD5 22be5b5571543b2c42be4bfc4543e145
- SHA1 302926a3ae9961ff77e7c4721c85a00c8e6c4cc1
- SHA512 0d4459881550e9bab9b05aca05c25c1306bed989d98a25a32b2b6b952fba6e0efcd2b16f02ca1f5e8952a5adca470db475c37414191a55ba881b2d436d403a46
- SSDEEP 49152:vxnwuUUImzX6LFMAVGnN6o9y6UCJUWZcGxU7qpD1Lpjz39+WtD8SoAC:ZwRUImrpw6I6vZcGe7qpFpvtFaSoAC
- TLSH
  T167C533DC27110BF4E6863679C5F7C357A228F8D20153852FCD98D92DBA8B7F8B069522
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection defense_evasion discovery evasion xloader_apk impact infostealer persistence trojan
- Family: XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
- Requests dangerous framework permissions
behavioral4