Extracted

• • Target
    jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Wroba.g.7e7c755be5203088c977e
  • Size 432KB
  • SHA256 9f62af95a120998923712d8b724c489782315435d3c9929d1dee88cc63e685a1
  • MD5 d9f5dc50fd17e7c755be5203088c977e
  • SHA1 b599f5ab69fe14130877c9324ba85a95aed0dc93
  • SHA512 c4e1e9241f15da27c0ce0fc243034cd5c845381958fa5d7b061e2bdf8edbfa65016a1767e0856d52b23ba633796f9b147c577ea0ee52a64c37fd37783a7d4fb2
  • SSDEEP 6144:PJhT9yN3Kxn4Pne3LmK1QwJH9jK697e5qeijEXilbmuQNHZ+6GazI6W5QcWv1Jms:BbG3Kx4mbmrAH9aqftoV5tUwvfqfQj
  • TLSH
    T1929423D2E06CF986EA46333D877A6EAB5149B1BBE44C03E7C73111A458912B0CF9C6DD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectiondefense_evasiondiscoveryevasionxloader_apkinfostealerpersistencestealthtrojan

  • Family: XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • XLoader payload

  • Checks if the Android device is rooted.

    defense_evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3