General
- Target cgwgbcsfwm.apk
- Size 3.1MB
- Sample260911-gzhraack4t
- SHA256 3033926b299917e5ee31ee01c64297e19c90b1e0fdb48bba097f89f44e8d18dc
Score
10/10
Malware Config
Targets
-
- Target cgwgbcsfwm.apk
- Size 3.1MB
- SHA256 3033926b299917e5ee31ee01c64297e19c90b1e0fdb48bba097f89f44e8d18dc
Score10/10-
Family: XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the MMS message.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Reads information about phone network operator.
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
1System Checks
1