Analysis

  • max time kernel
    4265671s
  • max time network
    134s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231023-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231023-enlocale:en-usos:android-11-x64system
  • submitted
    23/11/2023, 22:03

General

  • Target
    b46d602406b764442ed795a435c4e9e0f3173c805041e7c47dabac3bc883105a.apk
  • Size 205KB
  • Sample231123-1ye4jsdf3s
  • SHA256 b46d602406b764442ed795a435c4e9e0f3173c805041e7c47dabac3bc883105a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • XLoader payload 6 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

  • Removes its main activity from the application launcher 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • rb.yxms.vwh
    1⤵
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:4575

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        dex

        • Path /data/user/0/rb.yxms.vwh/files/dex
        • Size 454KB
        • SHA256 8c221b88e6755f04827bf176521a83a6e06ac054b3edca7aeb7c743a41fa01e6
        • MD5 SHA1 SHA512 SSDEEP

        dex

        • Path /data/user/0/rb.yxms.vwh/files/dex
        • Size 454KB
        • SHA256 8c221b88e6755f04827bf176521a83a6e06ac054b3edca7aeb7c743a41fa01e6
        • MD5 SHA1 SHA512 SSDEEP

        dex

        • Path /data/user/0/rb.yxms.vwh/files/dex
        • Size 454KB
        • SHA256 8c221b88e6755f04827bf176521a83a6e06ac054b3edca7aeb7c743a41fa01e6
        • MD5 SHA1 SHA512 SSDEEP