Analysis
-
max time kernel
567789s -
max time network
156s -
platform
android_x86_64 -
resource
android-x86_64 -
submitted
11-03-2021 15:08
Static task
static1
Behavioral task
behavioral1
Sample
dAdYrNg.apk
Resource
android-x86_64
android_x86_64
0 signatures
0 seconds
General
-
Target
dAdYrNg.apk
-
Size
218KB
-
MD5
cce6059446540919706260279c204608
-
SHA1
8aa0055a0d8c782204dbaccfc99545d2eb89d67d
-
SHA256
7d4d00a1ed508db997d98bc9bda0e9ed4e5115f5898b93f71ced5a1a92e44b6d
-
SHA512
b31dc057d12d5df5849f24ac00483529477b0e7beda1e43ff066798e42e7a33b28b5aed30073d184cbbdc9b6c839ca1de8000d49f4a7c9edf1c0a55eafde2e7d
Malware Config
Extracted
DES_key
Signatures
-
XLoader, MoqHao
An Android banker and info stealer.
-
pid Process 3561 yljl.ezlfo.eahln -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/yljl.ezlfo.eahln/files/dex 3561 yljl.ezlfo.eahln /data/user/0/yljl.ezlfo.eahln/files/dex 3561 yljl.ezlfo.eahln -
Uses reflection 64 IoCs
description pid Process Invokes method com.Loader.create 3561 yljl.ezlfo.eahln Invokes method android.content.ContextWrapper.getPackageManager 3561 yljl.ezlfo.eahln Invokes method android.app.ApplicationPackageManager.setComponentEnabledSetting 3561 yljl.ezlfo.eahln Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3561 yljl.ezlfo.eahln Invokes method com.Loader.start 3561 yljl.ezlfo.eahln Invokes method android.telephony.SignalStrength.getLevel 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln Invokes method android.os.PowerManager.isIgnoringBatteryOptimizations 3561 yljl.ezlfo.eahln -
64 IoCs
pid Process 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln 3561 yljl.ezlfo.eahln