Overview

overview

10

Static

static

6

7be196df22...7c.apk

android-9-x86

10

7be196df22...7c.apk

android-10-x64

10

7be196df22...7c.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7be196df227488c343fb42cfe03d4d07f64f7258b5bf5817c3dfec43c84f3f7c.bin

  • Size

    205KB

  • Sample

    240417-1zkenaff56

  • MD5

    de2adb5a6bf51ee31b68c8308a28e584

  • SHA1

    0d422dfe59ff20938decf321d4689985e680e679

  • SHA256

    7be196df227488c343fb42cfe03d4d07f64f7258b5bf5817c3dfec43c84f3f7c

  • SHA512

    ef207f97c65e13a34e76cf4be5bdee7eefa1ad01756eae2448a36a9519401e12af0d48f07efeba2a75edca5c60555d071590abc25b9c450cc3441b44acc19183

  • SSDEEP

    3072:04PB8nq7ezdpWXfcse2zsLiaCLCfTgpi/kmL6cOAbYdq8tZAFiuVuJ9mLwTx:04Z8qSzVskiaCL9i/kW6b1tKFLVuJkmx

Score
10/10
xloader_apkandroidbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Targets

    • Target

      7be196df227488c343fb42cfe03d4d07f64f7258b5bf5817c3dfec43c84f3f7c.bin

    • Size

      205KB

    • MD5

      de2adb5a6bf51ee31b68c8308a28e584

    • SHA1

      0d422dfe59ff20938decf321d4689985e680e679

    • SHA256

      7be196df227488c343fb42cfe03d4d07f64f7258b5bf5817c3dfec43c84f3f7c

    • SHA512

      ef207f97c65e13a34e76cf4be5bdee7eefa1ad01756eae2448a36a9519401e12af0d48f07efeba2a75edca5c60555d071590abc25b9c450cc3441b44acc19183

    • SSDEEP

      3072:04PB8nq7ezdpWXfcse2zsLiaCLCfTgpi/kmL6cOAbYdq8tZAFiuVuJ9mLwTx:04Z8qSzVskiaCL9i/kW6b1tKFLVuJkmx

    Score
    10/10
    xloader_apkbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

      trojaninfostealerbankerxloader_apk

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Queries account information for other applications stored on the device.

      Application may abuse the framework's APIs to collect account information stored on the device.

      collection

    • Queries the phone number (MSISDN for GSM devices)

      discovery

    • Reads the content of the MMS message.

      collection

    • Acquires the wake lock

    • Queries the unique device ID (IMEI, MEID, IMSI)

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks