Analysis

  • max time kernel
    3383852s
  • max time network
    166s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    15/05/2022, 21:44

General

  • Target
    4ac3058ee8c8d8fa3d780d86efb6266eede124645866c3fcc15256c1603eff9e.apk
  • Size 308KB
  • Sample220515-1lmmvsaghk
  • SHA256 4ac3058ee8c8d8fa3d780d86efb6266eede124645866c3fcc15256c1603eff9e
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • XLoader Payload 3 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • mnti.cb.bz
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:6028

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        dex

        • Path /data/user/0/mnti.cb.bz/files/dex
        • Size 580KB
        • SHA256 b8f6a3769331039a5f2dc29eba3adc431a7b086d47ec579cd143da11f137f13d
        • MD5 SHA1 SHA512 SSDEEP

        dex

        • Path /data/user/0/mnti.cb.bz/files/dex
        • Size 580KB
        • SHA256 b8f6a3769331039a5f2dc29eba3adc431a7b086d47ec579cd143da11f137f13d
        • MD5 SHA1 SHA512 SSDEEP

        dex

        • Path /data/user/0/mnti.cb.bz/files/dex
        • Size 580KB
        • SHA256 b8f6a3769331039a5f2dc29eba3adc431a7b086d47ec579cd143da11f137f13d
        • MD5 SHA1 SHA512 SSDEEP

        .msg_device_id.txt

        • Path /storage/emulated/0/.msg_device_id.txt
        • Size 36B
        • SHA256 7a07f61667e567369910b5642576cff53a8ff937a16263d77e140500079fe65a
        • MD5 SHA1 SHA512