Analysis
- max time kernel
265381s - max time network
93s - platform
android_x64 - resource
android-x64-20230621-en - resource tags
androidarch:x64arch:x86image:android-x64-20230621-enlocale:en-usos:android-10-x64system - submitted
19/08/2023, 22:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21164db1c45a8088f78d3b282951f93e1adcccec5829d7bc60de41b786b4d292.apk
Resource
android-x86-arm-20230621-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
21164db1c45a8088f78d3b282951f93e1adcccec5829d7bc60de41b786b4d292.apk
Resource
android-x64-20230621-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
21164db1c45a8088f78d3b282951f93e1adcccec5829d7bc60de41b786b4d292.apk
Resource
android-x64-arm64-20230621-en
7 signatures
150 seconds
General
- Target 21164db1c45a8088f78d3b282951f93e1adcccec5829d7bc60de41b786b4d292.apk
- Size 451KB
- Sample230819-1wrdssce63
- SHA256 21164db1c45a8088f78d3b282951f93e1adcccec5829d7bc60de41b786b4d292
- MD5 0d19e75a5017237de9c3e829178c175b
- SHA1 ac4b4b20af070aac9e203a39644b31361274fcf0
- SHA512 36ae7c9b24385a6011a8de7ff58bd5bdd21a6a81deca799afd2158af2a271af144fd36b195b965257a61501ca525d9b5a3ea7f8364d4dc7d52038bbaddf31ee0
- SSDEEP 12288:S7yqhOHDinbi4NuKDsVRiHNym6QD7qfBsS+b4dMoYG:03bNZIV8HL5S+cdMy
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
xloader_apk
C2
-
http://91.204.227.39:28844
DES_key
Signatures
- XLoader payload 3 IoCs
resource yara_rule behavioral2/files/4995-0.dat family_xloader_apk2 behavioral2/memory/4995-0.dex family_xloader_apk2 behavioral2/memory/4995-1.dex family_xloader_apk2 - XLoader, MoqHao
An Android banker and info stealer.
- Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.wugy.fkxa/files/dex 4995 com.wugy.fkxa /data/user/0/com.wugy.fkxa/files/dex 4995 com.wugy.fkxa - Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.wugy.fkxa
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.wugy.fkxa/files/dex
- Size 766KB
- SHA256 ff87cb92852a7d77c93494f73a3876fb3c3570115ffe73c2fcd08ae3ac1e3551
- MD5 7962ea579bddfb2d56deaeb75556d33a
- SHA1 292c29c70d73caff3148eb993fc389c58b966cde
- SHA512 bad435e79acad4d6c25ea5a580a12dde0e065a85677744c6428bf20ee03a55972d20416ca719f9254be886f20a00c2cd3e4816911e05ebab199e398bc4c6a0f4
- SSDEEP 12288:DxkouXnNRqWzXfLC+K9pO28m/CbEcaLS8m/CbEcaLeCZT4uQK+fD2hk4:DgzfLhK9pO28m/CbEcaLS8m/CbEcaLe2
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.wugy.fkxa/files/dex
- Size 766KB
- SHA256 ff87cb92852a7d77c93494f73a3876fb3c3570115ffe73c2fcd08ae3ac1e3551
- MD5 7962ea579bddfb2d56deaeb75556d33a
- SHA1 292c29c70d73caff3148eb993fc389c58b966cde
- SHA512 bad435e79acad4d6c25ea5a580a12dde0e065a85677744c6428bf20ee03a55972d20416ca719f9254be886f20a00c2cd3e4816911e05ebab199e398bc4c6a0f4
- SSDEEP 12288:DxkouXnNRqWzXfLC+K9pO28m/CbEcaLS8m/CbEcaLeCZT4uQK+fD2hk4:DgzfLhK9pO28m/CbEcaLS8m/CbEcaLe2
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.wugy.fkxa/files/dex
- Size 766KB
- SHA256 ff87cb92852a7d77c93494f73a3876fb3c3570115ffe73c2fcd08ae3ac1e3551
- MD5 7962ea579bddfb2d56deaeb75556d33a
- SHA1 292c29c70d73caff3148eb993fc389c58b966cde
- SHA512 bad435e79acad4d6c25ea5a580a12dde0e065a85677744c6428bf20ee03a55972d20416ca719f9254be886f20a00c2cd3e4816911e05ebab199e398bc4c6a0f4
- SSDEEP 12288:DxkouXnNRqWzXfLC+K9pO28m/CbEcaLS8m/CbEcaLeCZT4uQK+fD2hk4:DgzfLhK9pO28m/CbEcaLS8m/CbEcaLe2
- MD5 SHA1 SHA512 SSDEEP