General

  • Target

    Facebook.apk

  • Size

    390KB

  • Sample

    240223-r1xlyabb85

  • MD5

    7b2711729c871dbf685c70838fa8ae41

  • SHA1

    32ff7d6b8d98405a8d63ed1ee7de72ffd83d41da

  • SHA256

    466dafa82a4460dcad722d2ad9b8ca332e9a896fc59f06e16ebe981ad3838a6b

  • SHA512

    a21836c18e569d4e7010978ecac1dfa2b1e6289a5295d9203ffb50e514e8f8ba5a56940613ef18c5da7f5566834555481d8a84fbc81fad265b9b09fb71b00ab3

  • SSDEEP

    12288:mFyjiRyf6ZArI49XI2KZVs923eRC6tzFm3v0yRN:mYic6+I4xv+q9238Hm3v0y3

Malware Config

Targets

    • Target

      Facebook.apk

    • Size

      390KB

    • MD5

      7b2711729c871dbf685c70838fa8ae41

    • SHA1

      32ff7d6b8d98405a8d63ed1ee7de72ffd83d41da

    • SHA256

      466dafa82a4460dcad722d2ad9b8ca332e9a896fc59f06e16ebe981ad3838a6b

    • SHA512

      a21836c18e569d4e7010978ecac1dfa2b1e6289a5295d9203ffb50e514e8f8ba5a56940613ef18c5da7f5566834555481d8a84fbc81fad265b9b09fb71b00ab3

    • SSDEEP

      12288:mFyjiRyf6ZArI49XI2KZVs923eRC6tzFm3v0yRN:mYic6+I4xv+q9238Hm3v0y3

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads the content of the MMS message.

    • Acquires the wake lock

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks