Overview

overview

10

Static

static

6

df3538de6a...7a.apk

android-9-x86

10

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    26/03/2024, 12:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    df3538de6a20c43301a4e1f44429747a.apk

  • Size

    445KB

  • MD5

    df3538de6a20c43301a4e1f44429747a

  • SHA1

    3a3d0803f9f6999a1402ff469b1aa73c1ba066ea

  • SHA256

    e20059f5685a7cfe981447f4dad6f42a35d5b545622b0949a060af7742efe0d9

  • SHA512

    53d7737ab2d6c9fe06a754b061334526f8a1028ab06807afeb1e1652fe7b9ada8dd9cba34b3709e7dacfc0fb81f8ecb0fd5a64d659672d7d82a78af312239d8f

  • SSDEEP

    12288:gZu/w81UwnZDbu/D7DAEXqyqQnSMey7SQZyB:3/w81LZDK/D7Duy5g8kB

Score
10/10
xloader_apkbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Signatures

  • XLoader payload 2 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • h.wi.cljs
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Reads the contacts stored on the device.
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4243

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/h.wi.cljs/files/d
          Filesize

          454KB

          MD5

          d28e6b862a1aee68793e1b022f18306a

          SHA1

          9044c8b066fc6610bb53b2fe4fec1c8b3e5ae985

          SHA256

          05d35fa20111813c4e3063181b5b90d7f13a03856e6104f1dfc64c735055c76a

          SHA512

          64d6105fc4a17057c184804a6214a99e4f96326af423fa11cd7cc89ea0cd1c9e67e43e91ecbaf8ccea6b3175a05dc1d2a3dd1cbd0830d921dfbfb738ec874526

          Download Submit

        • /data/data/h.wi.cljs/files/oat/d.cur.prof
          Filesize

          1KB

          MD5

          94f3c4eebee4e91a8d1deb11d09d6c36

          SHA1

          01ebc988270b4c7bca265d775f3405526e294de5

          SHA256

          1728653df6a55b128d5b8d307c7a7c13ef5e16c435ad10bb585b7592f93872d9

          SHA512

          8f98fa0cdd3b67aa0b5f72dd2bbdf53c11d0a082c3c7e395ae5dc9fd636f24323e0fb38360f138b23fc8555042e6b5cc1293ebef97ed066558784b1404c50042

          Download Submit

        • /storage/emulated/0/.msg_device_id.txt
          Filesize

          36B

          MD5

          432a86cb6e4e66219c13142bcf3192fb

          SHA1

          ac7bdbddf19b8df6b908a174a9e9f4008e6a3185

          SHA256

          f05c48a653b461cbd2676e53ced111eb811e7b3386492e0ecc44cc461f546b4b

          SHA512

          178be8119db32043987dd01ed93342015e9d2d990b0ff9810ebe93619c82dee4741e5e06a13b48f5a6b0cd0f9e0f6827535e92f1a8c69f8b01b6559d85dfb83d

          Download Submit