Extracted

• • Target
    jaffacakes118_chrome.apk
  • Size 284KB
  • SHA256 70c21c61afad80d7ce7710215748236421cbfeb2ad2ce52f612b05001d8ee2a1
  • MD5 cbf31f5af7a0c1a624eb1965a1f581d0
  • SHA1 246e96e29b60fef0490da19150ec4a770e889d07
  • SHA512 15baa7c61df57319a20300493b03c4bb53ba1c497247128b375543ad4d3d16c30212a28c58f99fdac5f5e522d5a1a5b70cce5ea753cd275dd45eb53f9b93706c
  • SSDEEP 6144:aHdvwcehNrxorQ04hR33BhU3wYaoPaX4yH/3CYPM0cAFooppvj2:Yoce+M0OxL4aIyf3CYPAA/a
  • TLSH
    T133542384EDDDE520D1B3CB32D2005CD1E1AB9804CCDA5F469A5F9B7B38E3C5A875CA26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectiondefense_evasiondiscoveryevasionxloader_apkimpactinfostealerpersistencetrojan

  • Family: XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk

  • XLoader payload

  • Checks if the Android device is rooted.

    defense_evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the content of the MMS message.

    collection

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Requests changing the default SMS application.

    collectionimpact

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1