Analysis
- max time kernel
1179789s - max time network
163s - platform
android_x64 - resource
android-x64-20220310-en - submitted
20/04/2022, 09:14
Static task
static1
Behavioral task
behavioral1
Sample
94ecb0ca511764d819641cf7c45d11f067abd21697a7bd200160b020e6c9bd98.apk
Resource
android-x86-arm-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
94ecb0ca511764d819641cf7c45d11f067abd21697a7bd200160b020e6c9bd98.apk
Resource
android-x64-20220310-en
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
94ecb0ca511764d819641cf7c45d11f067abd21697a7bd200160b020e6c9bd98.apk
Resource
android-x64-arm64-20220310-en
0 signatures
0 seconds
General
- Target 94ecb0ca511764d819641cf7c45d11f067abd21697a7bd200160b020e6c9bd98.apk
- Size 303KB
- Sample220420-k7eldabael
- SHA256 94ecb0ca511764d819641cf7c45d11f067abd21697a7bd200160b020e6c9bd98
- MD5 f343110a995940e3e477ba66d1b71bbc
- SHA1 eb48fd144c3e226c22bc4515ce333c61e9653cc2
- SHA512 cdde6794197ff6b0ca4901c17e5d9c7161b320282d3606b2088761f399d1a6a07ef4783b19c5e1f959ad1954c6dc3577e2c655208bd46856c438eac81e35831a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- XLoader Payload 3 IoCs
resource yara_rule behavioral2/files/6173-0.dat family_xloader_apk behavioral2/memory/6173-0.dex family_xloader_apk behavioral2/memory/6173-1.dex family_xloader_apk - XLoader, MoqHao
An Android banker and info stealer.
- Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/hkqj.esewm.gbcqm/files/dex 6173 hkqj.esewm.gbcqm /data/user/0/hkqj.esewm.gbcqm/files/dex 6173 hkqj.esewm.gbcqm - Reads information about phone network operator.
- Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal hkqj.esewm.gbcqm
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/hkqj.esewm.gbcqm/files/dex
- Size 580KB
- SHA256 7a60fc73f461b0c1dfb9c9786b44abd00e1c2034440397019a5225631e4679e4
- MD5 f51fa0481451ad4df6c3686f2a41e29a
- SHA1 c38c35f5da0921eedeb256986fbd6bb00314ec0e
- SHA512 af7cbefadd5fce52a10daffb4073154dfab2240616669d3050910eb03a254a6d73932caf5db827fd12d35f217bc79e75524c81b41a7740e050468e37ff96efd9
- SSDEEP 12288:FxaGHR3+miRY698m/CbEcaLz8m/CbEcaLq8m/CbEcaLb8m/CbEcaLUHyPs8B:FxPoW698m/CbEcaLz8m/CbEcaLq8m/CW
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/hkqj.esewm.gbcqm/files/dex
- Size 580KB
- SHA256 7a60fc73f461b0c1dfb9c9786b44abd00e1c2034440397019a5225631e4679e4
- MD5 f51fa0481451ad4df6c3686f2a41e29a
- SHA1 c38c35f5da0921eedeb256986fbd6bb00314ec0e
- SHA512 af7cbefadd5fce52a10daffb4073154dfab2240616669d3050910eb03a254a6d73932caf5db827fd12d35f217bc79e75524c81b41a7740e050468e37ff96efd9
- SSDEEP 12288:FxaGHR3+miRY698m/CbEcaLz8m/CbEcaLq8m/CbEcaLb8m/CbEcaLUHyPs8B:FxPoW698m/CbEcaLz8m/CbEcaLq8m/CW
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/hkqj.esewm.gbcqm/files/dex
- Size 580KB
- SHA256 7a60fc73f461b0c1dfb9c9786b44abd00e1c2034440397019a5225631e4679e4
- MD5 f51fa0481451ad4df6c3686f2a41e29a
- SHA1 c38c35f5da0921eedeb256986fbd6bb00314ec0e
- SHA512 af7cbefadd5fce52a10daffb4073154dfab2240616669d3050910eb03a254a6d73932caf5db827fd12d35f217bc79e75524c81b41a7740e050468e37ff96efd9
- SSDEEP 12288:FxaGHR3+miRY698m/CbEcaLz8m/CbEcaLq8m/CbEcaLb8m/CbEcaLUHyPs8B:FxPoW698m/CbEcaLz8m/CbEcaLq8m/CW
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/.msg_device_id.txt
- Size 36B
- SHA256 c07d2e4f840852285a1ff8d33def336e204171af2695073477ddf0be66f2a422
- MD5 8a99f692aaaaf484d28f87a10fcfd698
- SHA1 efad4d7b4e7bb59254e4473fc4bdb5027a5c55f1
- SHA512 62f8b2fe3d3903214600d71e64365be2ee10e5996f229d47c436bebffe967cfdbe49b4295b6627f87f3c982e781beb6502d6d496c33c6d3eee155af473ae5c57
- MD5 SHA1 SHA512