General
-
Target
bc6c115a982b7e43613f8463c6363bfcb73512eb16030efe5933b98edacf6045.bin
-
Size
408KB
-
Sample
240629-1y3vlsxdmd
-
MD5
dacfc5cc53bbd2ae83ed427bd094f65c
-
SHA1
196642665f8124ceb10c67148d5f2d955d650777
-
SHA256
bc6c115a982b7e43613f8463c6363bfcb73512eb16030efe5933b98edacf6045
-
SHA512
24ee1f4e147c9971ca81333ef546fa102407c44e4c8def03d0365b07313d3de86b1e7517d470d3d88adc69e2295eb373060d7904d8d991fee8c79589cc67ff3b
-
SSDEEP
6144:6yQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuUaPpuCsq66p5exL4w:iDNUHiiQDhu0vUEbqmEYxXaP/IHLJ
Static task
static1
Behavioral task
behavioral1
Sample
bc6c115a982b7e43613f8463c6363bfcb73512eb16030efe5933b98edacf6045.apk
Resource
android-x86-arm-20240624-en
Malware Config
Extracted
xloader_apk
http://91.204.227.50:28899
Targets
-
-
Target
bc6c115a982b7e43613f8463c6363bfcb73512eb16030efe5933b98edacf6045.bin
-
Size
408KB
-
MD5
dacfc5cc53bbd2ae83ed427bd094f65c
-
SHA1
196642665f8124ceb10c67148d5f2d955d650777
-
SHA256
bc6c115a982b7e43613f8463c6363bfcb73512eb16030efe5933b98edacf6045
-
SHA512
24ee1f4e147c9971ca81333ef546fa102407c44e4c8def03d0365b07313d3de86b1e7517d470d3d88adc69e2295eb373060d7904d8d991fee8c79589cc67ff3b
-
SSDEEP
6144:6yQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuUaPpuCsq66p5exL4w:iDNUHiiQDhu0vUEbqmEYxXaP/IHLJ
-
XLoader payload
-
Checks if the Android device is rooted.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the MMS message.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-