Resubmissions

23/04/2022, 16:24

220423-twexfadcc810

20/04/2022, 09:14

220420-k7eldabael10

Analysis

  • max time kernel
    1179789s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    20/04/2022, 09:14

General

  • Target
    94ecb0ca511764d819641cf7c45d11f067abd21697a7bd200160b020e6c9bd98.apk
  • Size 303KB
  • Sample220420-k7eldabael
  • SHA256 94ecb0ca511764d819641cf7c45d11f067abd21697a7bd200160b020e6c9bd98
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • XLoader Payload 3 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • hkqj.esewm.gbcqm
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:6173

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        dex

        • Path /data/user/0/hkqj.esewm.gbcqm/files/dex
        • Size 580KB
        • SHA256 7a60fc73f461b0c1dfb9c9786b44abd00e1c2034440397019a5225631e4679e4
        • MD5 SHA1 SHA512 SSDEEP

        dex

        • Path /data/user/0/hkqj.esewm.gbcqm/files/dex
        • Size 580KB
        • SHA256 7a60fc73f461b0c1dfb9c9786b44abd00e1c2034440397019a5225631e4679e4
        • MD5 SHA1 SHA512 SSDEEP

        dex

        • Path /data/user/0/hkqj.esewm.gbcqm/files/dex
        • Size 580KB
        • SHA256 7a60fc73f461b0c1dfb9c9786b44abd00e1c2034440397019a5225631e4679e4
        • MD5 SHA1 SHA512 SSDEEP

        .msg_device_id.txt

        • Path /storage/emulated/0/.msg_device_id.txt
        • Size 36B
        • SHA256 c07d2e4f840852285a1ff8d33def336e204171af2695073477ddf0be66f2a422
        • MD5 SHA1 SHA512