xhelper | 69344c280d9c6efe22758c2e008920f0823f5bacef27e9c4eb3eab28117d927d

General

Target
xhelper.apk
Size 252KB
Sample260804-tssdcsstfz
SHA256 69344c280d9c6efe22758c2e008920f0823f5bacef27e9c4eb3eab28117d927d
MD5 6f3e67ffe0fae70074d1855a31de58b0
SHA1 52b3a9ca753f16b7dd7f59a408b1b71cc5f36ae0
SHA512 4ef840cbbe8e0a6815e086e4aa04a388d889035dabcbfab3034034cfa4e0350803881475de3b724d00365d966a1298da9e2f23bca913cd20966c5c4746a21ea4
SSDEEP 6144:E1Yf24lyfxjgYIcRbqGQGhFLE5RDRWPwbUcgPVK8:QYJU5UDc84Ffwb/gPVK8
TLSH
T17744126FC9E87ABDE16D07F60433F299E4618181D80AEECA0776DBE8198C57115F4F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  xhelper.apk
- Size 252KB
- SHA256 69344c280d9c6efe22758c2e008920f0823f5bacef27e9c4eb3eab28117d927d
- MD5 6f3e67ffe0fae70074d1855a31de58b0
- SHA1 52b3a9ca753f16b7dd7f59a408b1b71cc5f36ae0
- SHA512 4ef840cbbe8e0a6815e086e4aa04a388d889035dabcbfab3034034cfa4e0350803881475de3b724d00365d966a1298da9e2f23bca913cd20966c5c4746a21ea4
- SSDEEP 6144:E1Yf24lyfxjgYIcRbqGQGhFLE5RDRWPwbUcgPVK8:QYJU5UDc84Ffwb/gPVK8
- TLSH
  T17744126FC9E87ABDE16D07F60433F299E4618181D80AEECA0776DBE8198C57115F4F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion xhelper impact infostealer persistence trojan
- Family: xHelper
  xHelper is a stubborn Android trojan that can reinstall itself after a factory reset.
  trojan infostealer xhelper
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral1