xloader_apk | f62b9780e87a1b882125902197894ab4f24960ef47f6aa17855fbdd99f4798e5

Analysis

max time kernel
149s
max time network
131s
platform
android_x64
resource
android-x64-arm64-20240506-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
submitted
09-05-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f62b9780e87a1b882125902197894ab4f24960ef47f6aa17855fbdd99f4798e5.apk
Size

205KB
MD5

5795d42dd52b8de0150da1bccf254f39
SHA1

d64cb9cb2735e8b9448298556cd1ae73d67414c7
SHA256

f62b9780e87a1b882125902197894ab4f24960ef47f6aa17855fbdd99f4798e5
SHA512

1542b53ecc4828de04742fa694765eca322a8131e37cdf616a430044cb23e2647d1a3180b4651c354740abcba5a56a75e763dd54832be28c9b2dca60980f4169
SSDEEP

3072:TjMc+vZGSozEYQ6gLD4zlROiv8pWgy6bTOpuFFyIMDb9aoavzIJLnzkEC:TP+v4xo4Rfv8pyX6DMDBAG5C

Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

Malware Config

Extracted

Family

xloader_apk

http://91.204.227.39:28844

DES_key

Signatures

XLoader payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/iaga.iotso.kuhff/files/dex	family_xloader_apk
/data/user/0/iaga.iotso.kuhff/files/dex	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

iaga.iotso.kuhff

pid process

4937 iaga.iotso.kuhff
Requests changing the default SMS application. 2 TTPs 1 IoCs
collection impact

SMS Messages
T1636.004

SMS Control
T1582

Processes:

iaga.iotso.kuhff

description ioc process

Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT iaga.iotso.kuhff
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

iaga.iotso.kuhff

ioc pid process

/data/user/0/iaga.iotso.kuhff/files/dex 4937 iaga.iotso.kuhff
/data/user/0/iaga.iotso.kuhff/files/dex 4937 iaga.iotso.kuhff
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

iaga.iotso.kuhff

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground iaga.iotso.kuhff
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

iaga.iotso.kuhff

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser iaga.iotso.kuhff
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads the content of the MMS message. 1 TTPs 1 IoCs
collection

SMS Messages
T1636.004

Processes:

iaga.iotso.kuhff

description ioc process

URI accessed for read content://mms/ iaga.iotso.kuhff
Acquires the wake lock 1 IoCs

Processes:

iaga.iotso.kuhff

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock iaga.iotso.kuhff
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

iaga.iotso.kuhff

description ioc process

Framework API call javax.crypto.Cipher.doFinal iaga.iotso.kuhff

pid	process
4937	iaga.iotso.kuhff

description	ioc	process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	iaga.iotso.kuhff

ioc	pid	process
/data/user/0/iaga.iotso.kuhff/files/dex	4937	iaga.iotso.kuhff
/data/user/0/iaga.iotso.kuhff/files/dex	4937	iaga.iotso.kuhff

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	iaga.iotso.kuhff

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	iaga.iotso.kuhff

description	ioc	process
URI accessed for read	content://mms/	iaga.iotso.kuhff

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	iaga.iotso.kuhff

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	iaga.iotso.kuhff

iaga.iotso.kuhff
1⤵
- Removes its main activity from the application launcher
- Requests changing the default SMS application.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4937

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

SMS Control

T1582

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/iaga.iotso.kuhff/files/dex
Filesize
454KB

MD5
c908b637c002940ef72c0f34eda33115

SHA1
c886b4786f696ca4be26516a83e842863e71f728

SHA256
125b57669edb6060fea0e71718ea17c957186496c2c1ea010d95c64218fe31ae

SHA512
57eafa70138d9b97af7c3160306133f1591f015563f4ebe21cb4a0354a6c2a380e246de64ea54d492e84d433b77b50d887ebdd3566002799abdeba66742ec350

Download Submit
/data/user/0/iaga.iotso.kuhff/files/oat/dex.cur.prof
Filesize
1KB

MD5
ff0eed34661dfdbe6d3c10e1b919fee7

SHA1
3ddddbe54c58beaee7280a0c6694e7b75e823f1b

SHA256
13a681ecd29aed640ab5e40446760da83612265225a3e6507514fea6a5704e33

SHA512
d59a323c65fc7cedaa7802c226de0b4bf878aeaa73c09f3d594090024d2627b138fa8e0fa8c18e48c23fe0b3b709850dba7c75c8fcb617c742cc802144b36103

Download Submit
/storage/emulated/0/.msg_device_id.txt
Filesize
36B

MD5
e616bf15a75056d9f0c41c8e399d7e06

SHA1
1a1ee8a806ab04300c080c2625a8bd69aee44e85

SHA256
b540a4d101095738edc0ca8ce3bc36af7aad01fc511e190bf459cfd74b08a1d7

SHA512
ce3799886d5cfdbf40241eb30dd7c7b343bfabd357582666d97836c4f6eb2a8fe1e29249cf0057ebe9612a9932038746c123fbb6104baecee1fbab2724a8815b

Download Submit