Analysis

  • max time kernel
    2739588s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    08/05/2022, 07:53

General

  • Target
    d359e7bf4f45fee67d4db5e92f2e45a7be9f5dc48a7addb9ab9d04f5bd205194.apk
  • Size 302KB
  • Sample220508-jrbdcabhe5
  • SHA256 d359e7bf4f45fee67d4db5e92f2e45a7be9f5dc48a7addb9ab9d04f5bd205194
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • XLoader Payload 3 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • onhw.hzysf.wdjoj
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:6179

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        dex

        • Path /data/user/0/onhw.hzysf.wdjoj/files/dex
        • Size 580KB
        • SHA256 0cd2b17aa21cd8de63842da21e3464df7bb2bd4a278fffbbfea6b294c3ca9e6d
        • MD5 SHA1 SHA512 SSDEEP

        dex

        • Path /data/user/0/onhw.hzysf.wdjoj/files/dex
        • Size 580KB
        • SHA256 0cd2b17aa21cd8de63842da21e3464df7bb2bd4a278fffbbfea6b294c3ca9e6d
        • MD5 SHA1 SHA512 SSDEEP

        dex

        • Path /data/user/0/onhw.hzysf.wdjoj/files/dex
        • Size 580KB
        • SHA256 0cd2b17aa21cd8de63842da21e3464df7bb2bd4a278fffbbfea6b294c3ca9e6d
        • MD5 SHA1 SHA512 SSDEEP

        .msg_device_id.txt

        • Path /storage/emulated/0/.msg_device_id.txt
        • Size 36B
        • SHA256 31fe488f3198ae652f41888ed80967b6d28f203c00abf570102950741afcaf95
        • MD5 SHA1 SHA512