xloader_apk | 9a392f8ff5d509b79ddcd17296455de84e33611c1161aeb1104bcb047d2e8c20 | Triage™

Resubmissions

04/11/2021, 05:57

211104-gn4jlsdacr10

01/11/2021, 22:36

211101-2h8llaahf310

Analysis

max time kernel
3918238s
max time network
335s
platform
android_x64
resource
android-x64-arm64
submitted
04/11/2021, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kuronekoyamato.apk
Size 444KB
Sample211104-gn4jlsdacr
SHA256 9a392f8ff5d509b79ddcd17296455de84e33611c1161aeb1104bcb047d2e8c20
MD5 a36de18d2b7572d2f291c1defd7bd9e1
SHA1 0b7c47c94428e15e9645517328ee8d0792bfe9fe
SHA512 7d3df77211783c70175a47cac0d76617b573f01f668d33b0291e95d19a43038427c5b81027ebb03f506ac8d9ea34657e5a0dcb4bc4503e68190b0487410b3f20
MD5 SHA1 SHA512

Score

10^/10

xloader_apk banker infostealer ransomware trojan

Malware Config

Signatures

XLoader Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4358-0.dex	family_xloader_apk
behavioral2/memory/4358-1.dex	family_xloader_apk

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/kt.gxa.fhyb.eqchv.gvi/files/d	4358	kt.gxa.fhyb.eqchv.gvi
/data/user/0/kt.gxa.fhyb.eqchv.gvi/files/d	4358	kt.gxa.fhyb.eqchv.gvi

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	kt.gxa.fhyb.eqchv.gvi

kt.gxa.fhyb.eqchv.gvi
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4358

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads