Extracted

Extracted

• • Target
    qtrqfnlgvn.apk
  • Size 3.1MB
  • SHA256 6e3ce6227a342b11ea992a2b0a729a57d1841788d694f7a46212486fadca5088
  • MD5 76ab7dda0aefad4d7e139395024d0200
  • SHA1 e6fc7f5a4560f440330b1792113a0e1758807e80
  • SHA512 6355b8d1b0e68ad50811d929d17404d1774199cb073c20d2e1d45f3c517ae7abc6681fd89ffe851ec3abe8973d429a12c2c9389534896d8ecb8656309bebe411
  • SSDEEP 49152:EYMNRSHtRTA8W1mEA5mKYOQUPWwQESryY6ARc8pxsaA:EYiSHtR88TE4mKjlWwQxryYe
  • TLSH
    T1E3E5E013E7028E66C89E5339A9FB17D023316604BE87531E344DC5B8AF4B1EA57DABC4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectiondefense_evasiondiscoveryevasionxloader_apkimpactinfostealerpersistencetrojan

  • Family: XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • Checks if the Android device is rooted.

    defense_evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries account information for other applications stored on the device

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1