Analysis
- max time kernel
2118796s - max time network
162s - platform
android_x64 - resource
android-x64-arm64-20230621-en - resource tags
- submitted
22/07/2023, 15:37
General
- Target 8f9f510b714d8753c63b8f9ad4588f6148e0898763f4e33dac617e1470ac4d5f.apk
- Size 282KB
- Sample230722-s2nabsbc68
- SHA256 8f9f510b714d8753c63b8f9ad4588f6148e0898763f4e33dac617e1470ac4d5f
Score
10/10
Malware Config
Extracted
Family
-
xloader_apk
C2
-
http://91.204.227.33:28899
DES_key
Signatures
- XLoader payload 2 IoCs
- XLoader, MoqHao
An Android banker and info stealer.
- Acquires the wake lock. 1 IoCs
- Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
- Reads information about phone network operator.
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
ic.dvfeoy.pmmfv.vfkgk1⤵
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
b
b
.msg_device_id.txt