General

  • Target

    b55aea38221acb4f5b1719c54e24063649827b2e792c134fb2f7b8923a49e135.bin

  • Size

    207KB

  • Sample

    210208-pxd1ez27h2

  • MD5

    d8bc0989f1ad505157c8a8d0d90f31fb

  • SHA1

    7a620b7c75c8a84184ed4ac2ba320a586d08de0f

  • SHA256

    b55aea38221acb4f5b1719c54e24063649827b2e792c134fb2f7b8923a49e135

  • SHA512

    fb5adbed5c9934841db6cd3fee024f32776be53ca092dc33897441b4699e0358b5cdb989dd0f17fbb9de591bf933070481c16b26bc610b474d6ea651800cc410

Malware Config

Extracted

DES_key

Targets

    • Target

      b55aea38221acb4f5b1719c54e24063649827b2e792c134fb2f7b8923a49e135.bin

    • Size

      207KB

    • MD5

      d8bc0989f1ad505157c8a8d0d90f31fb

    • SHA1

      7a620b7c75c8a84184ed4ac2ba320a586d08de0f

    • SHA256

      b55aea38221acb4f5b1719c54e24063649827b2e792c134fb2f7b8923a49e135

    • SHA512

      fb5adbed5c9934841db6cd3fee024f32776be53ca092dc33897441b4699e0358b5cdb989dd0f17fbb9de591bf933070481c16b26bc610b474d6ea651800cc410

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks