xloader_apk | 18cd953af0784a8bd152a6b5b9989b84709697de6ced9c85cc2fec70a94ac410

Analysis

max time kernel
155s
max time network
164s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
08/02/2024, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18cd953af0784a8bd152a6b5b9989b84709697de6ced9c85cc2fec70a94ac410.apk
Size 360KB
Sample240208-11tpqadc49
SHA256 18cd953af0784a8bd152a6b5b9989b84709697de6ced9c85cc2fec70a94ac410
MD5 c4366355da8dc9e6ddd4ce121814570c
SHA1 8ec38919cdfa78b568d90cf545cf4aac27c84117
SHA512 c6af4284d83657d7983d198c21d7e646ca40431f19cd22c996c7f5d5963f2daa715ccb5480c1e40f581d596866113e358a7e80efa5dfb3113383c45035dc915c
SSDEEP 6144:mwC4em01w0UnqcQsKt7DZejoPEh/4uPv8LVMKHEyfwCQqN1xzZNAVHaSmdqY:Hr01w0UqcdMgbhr8mKHEyfhtyu3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xloader_apk banker infostealer stealth trojan

Malware Config

Extracted

Family

xloader_apk

http://220.136.78.2:28844

AES_key

Signatures

XLoader payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4999	ertt.fgh.nfg

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/ertt.fgh.nfg/files/test.dex	4999	ertt.fgh.nfg
/data/user/0/ertt.fgh.nfg/files/test.dex	4999	ertt.fgh.nfg

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ertt.fgh.nfg

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ertt.fgh.nfg

ertt.fgh.nfg
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4999

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

test.dex

Path /data/data/ertt.fgh.nfg/files/test.dex
Size 621KB
SHA256 a2fafbb7cb9fab38aa31f1e14a6302ac528bb891b6063c6db12737a53d29cde7
MD5 7aa46b4d67c3ab07caa53e8d8df3005c
SHA1 7e92fefd5e4991aad951e9b9ec16be5c0d6633dd
SHA512 7c20129e06f0ec64c157698e6dc4a5ad15e820c9ccefffb9798aff533d1da1a50370dad764b8da13fc9553daa7b9832d4c7d8f56ebc8b622ff4d65d810a4eb8d
SSDEEP 6144:scGGiQ+2XgGNdwTEdqucqY103/9hQnYEVeDw2HJRDSO/i8FruxU20H9TB2+Ss3BO:7GhTeO0fQnYEVeD5zFRSxp
MD5 SHA1 SHA512 SSDEEP

Submit Download