Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240229-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
  • submitted
    23-04-2024 22:03

General

  • Target

    0430c9730f04bdd35934df362f75200ffb395aa525050180b81163e2efb0c512.apk

  • Size

    208KB

  • MD5

    92d986b79135f470b231cadfa29c04a8

  • SHA1

    4979646ec5ffc2a219f2189baa6f5d9b6b52997e

  • SHA256

    0430c9730f04bdd35934df362f75200ffb395aa525050180b81163e2efb0c512

  • SHA512

    ae0556171f117191fc08152722ffd9f80ae7103149e77b7c7478380e4c54315dd4e7d0fcac210825c5b449ea0bcd217902f09045add383381c588903e8fb5852

  • SSDEEP

    6144:cpHWuD6oxR0EYDLz7WqUwwWKkfkwN3y3ciF0+dRtN:cBR0DLz7SClfkv++dRtN

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Signatures

  • XLoader payload 2 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • n.khbi.chp
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4285

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/n.khbi.chp/files/d

    Filesize

    446KB

    MD5

    8bb09c2927ef88bda95970b61599f314

    SHA1

    391656ad53355854928f21a99e995f14e5c75ce7

    SHA256

    27ec66655a2a5e63f95ec2a4066bf7e64a79d7070923f42ba0cbffe53e2ba2dd

    SHA512

    94f59ce40f5b0a03c7bf0c4d199b47c4c7f85f98ae686f6994d74119f7c4b76d031d8607a879818d92c9097ce7603dbfef55d850186a21add9dee18f2bf90d68

  • /storage/emulated/0/.msg_device_id.txt

    Filesize

    36B

    MD5

    5f3fe65a56d761d889f141e6cf35355a

    SHA1

    6b8bae3e3be2098d8b003492ee8bb53d5787e527

    SHA256

    2134fc610227ee1db79b49219c1b62c8da30c0340e3bc5f7b08be48e1276bfce

    SHA512

    496f348a0931d9094f6dbd4381adb67a621ba4440ba22edd9d708bb447fafd6d813e2792937ff13f81bdacc930fe4e5660045cc7b8bab21c91c2183c3e60d5c6