Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    23-04-2024 22:03

General

  • Target

    d2f85c49327e0b23f792cd0ceace50afeb62a0b4b2cf789be372a84587018350.apk

  • Size

    283KB

  • MD5

    d7d7385d3a170ecb73c41303cd9099bf

  • SHA1

    d0c5be1c99d8dfb60d331a5185f3a74f35328514

  • SHA256

    d2f85c49327e0b23f792cd0ceace50afeb62a0b4b2cf789be372a84587018350

  • SHA512

    2c1f0cae73c38cac5e0c8758b0f0bbb2747d1c06aef980c3ece8dcc9e2234872dc86f6cd160adc7f5f83a6bd9b9b0ea9f19c992e010ba78e24cd651d5b233c0f

  • SSDEEP

    6144:sipUt2YM7o5jnqo5UvE02OuAoogmp6uIZkpBcxqjpDY1:s0cmosJvEVogO6H0xY1

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Signatures

  • XLoader payload 1 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • kukd.ft.xhybxi.eskjs
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4453

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/kukd.ft.xhybxi.eskjs/files/b

    Filesize

    505KB

    MD5

    1948f47b3ea40b56b95c2afea1715414

    SHA1

    5c690f45283971be674c6d8a2e54175b0ecf55eb

    SHA256

    55e4054d9045b3a34d808883c387d64cbae6a402ba7551f1c7a19d6b2bcc5ae7

    SHA512

    8f3e40ff08f864901147cd60dd88191b9f792a746f0d923e3fea3a30f1ce951ec984013641b32ce1130b764f3d27974ac1a4a9d281090c8bbbff02808ffeb436

  • /data/user/0/kukd.ft.xhybxi.eskjs/files/oat/b.cur.prof

    Filesize

    1KB

    MD5

    3b577ec5b6fd3aea9d73ba2ac11e2936

    SHA1

    1565bb473b97af4f73b957a0a8c5af42e1cc359b

    SHA256

    8a7f1aedc0991cce5ddd1ea6469f8a725702e8326b082efeb16f73e64289f732

    SHA512

    24ff4aebad0acaef5c52e7d8411fdb946084c57f88044e5d5e4ada42a52460167a3a6165be8aa36df8d0667cf862dd3e99d3d4e35768e5a70ea2d69991e1c262

  • /storage/emulated/0/.msg_device_id.txt

    Filesize

    36B

    MD5

    b24a4479d7dce163e2b1a04440432dca

    SHA1

    2bf5e561b1a205484d29ccb3569e76628bef979c

    SHA256

    e72e0abafda530d7172da6f976f3405813a180fb880d23f0ad6ccded00dfaaca

    SHA512

    4a9f2a155d5f3de6e4b58ed07a1f73002ff116ba49da87120f472ad7ce21884ecea2993ce7949fe9ce23c68feb4a10056140f000cebd5d56c00e6ecf19207606