Analysis
-
max time kernel
150s -
max time network
146s -
platform
android_x64 -
resource
android-33-x64-arm64-20240229-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system -
submitted
23-04-2024 22:03
Static task
static1
Behavioral task
behavioral1
Sample
0430c9730f04bdd35934df362f75200ffb395aa525050180b81163e2efb0c512.apk
Resource
android-33-x64-arm64-20240229-en
General
-
Target
0430c9730f04bdd35934df362f75200ffb395aa525050180b81163e2efb0c512.apk
-
Size
208KB
-
MD5
92d986b79135f470b231cadfa29c04a8
-
SHA1
4979646ec5ffc2a219f2189baa6f5d9b6b52997e
-
SHA256
0430c9730f04bdd35934df362f75200ffb395aa525050180b81163e2efb0c512
-
SHA512
ae0556171f117191fc08152722ffd9f80ae7103149e77b7c7478380e4c54315dd4e7d0fcac210825c5b449ea0bcd217902f09045add383381c588903e8fb5852
-
SSDEEP
6144:cpHWuD6oxR0EYDLz7WqUwwWKkfkwN3y3ciF0+dRtN:cBR0DLz7SClfkv++dRtN
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 2 IoCs
Processes:
resource yara_rule /data/user/0/n.khbi.chp/files/d family_xloader_apk /data/user/0/n.khbi.chp/files/d family_xloader_apk2 -
XLoader, MoqHao
An Android banker and info stealer.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
n.khbi.chpioc pid process /data/user/0/n.khbi.chp/files/d 4285 n.khbi.chp -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
n.khbi.chpdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground n.khbi.chp -
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
n.khbi.chpdescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser n.khbi.chp -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
Processes:
n.khbi.chpdescription ioc process URI accessed for read content://mms/ n.khbi.chp -
Acquires the wake lock 1 IoCs
Processes:
n.khbi.chpdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock n.khbi.chp -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
n.khbi.chpdescription ioc process Framework API call javax.crypto.Cipher.doFinal n.khbi.chp
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
446KB
MD58bb09c2927ef88bda95970b61599f314
SHA1391656ad53355854928f21a99e995f14e5c75ce7
SHA25627ec66655a2a5e63f95ec2a4066bf7e64a79d7070923f42ba0cbffe53e2ba2dd
SHA51294f59ce40f5b0a03c7bf0c4d199b47c4c7f85f98ae686f6994d74119f7c4b76d031d8607a879818d92c9097ce7603dbfef55d850186a21add9dee18f2bf90d68
-
Filesize
36B
MD55f3fe65a56d761d889f141e6cf35355a
SHA16b8bae3e3be2098d8b003492ee8bb53d5787e527
SHA2562134fc610227ee1db79b49219c1b62c8da30c0340e3bc5f7b08be48e1276bfce
SHA512496f348a0931d9094f6dbd4381adb67a621ba4440ba22edd9d708bb447fafd6d813e2792937ff13f81bdacc930fe4e5660045cc7b8bab21c91c2183c3e60d5c6