xloader_apk | 5e20247fa21ddb68b19d285dac13119d224f530ffd828c24c1d53d817edcc632

General

Target
wgjoabbksb.apk
Size 3.1MB
Sample260913-pf7kasba46
SHA256 5e20247fa21ddb68b19d285dac13119d224f530ffd828c24c1d53d817edcc632
MD5 151015f08d69cfe2bcde87d41459857d
SHA1 c43546ebb736937d35797a8c9b0e0161d869dcde
SHA512 1c12798953facf43aa11cc81c6b976fe504da6b27efc3d18acd48fabe03cb5645599479546fbe8a280074bee71cf4514f4f51b6deb74e4e7f52e349654e7493d
SSDEEP 49152:K+7g0HalWXtsigxW1mEA5mKYOQUPWwB2LZ7pcSc8pqsaaU:K+bH+WXuZTE4mKjlWwBCZ7pcwU
TLSH
T1F2E5E003BA018E72D49E5339AAEB1B5027317640BE979707341C85B9EF9B0F91BD6BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  wgjoabbksb.apk
- Size 3.1MB
- SHA256 5e20247fa21ddb68b19d285dac13119d224f530ffd828c24c1d53d817edcc632
- MD5 151015f08d69cfe2bcde87d41459857d
- SHA1 c43546ebb736937d35797a8c9b0e0161d869dcde
- SHA512 1c12798953facf43aa11cc81c6b976fe504da6b27efc3d18acd48fabe03cb5645599479546fbe8a280074bee71cf4514f4f51b6deb74e4e7f52e349654e7493d
- SSDEEP 49152:K+7g0HalWXtsigxW1mEA5mKYOQUPWwB2LZ7pcSc8pqsaaU:K+bH+WXuZTE4mKjlWwBCZ7pcwU
- TLSH
  T1F2E5E003BA018E72D49E5339AAEB1B5027317640BE979707341C85B9EF9B0F91BD6BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection defense_evasion discovery evasion xloader_apk impact infostealer persistence trojan
- Family: XLoader, MoqHao
  An Android banker and info stealer.
  trojan infostealer banker xloader_apk
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the MMS message.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
behavioral1