xloader_apk | 96e9077187317b26889fe9a6c765f57f2029a36bf288455ae35d4276581a86b7

General

Target

3738079a19b26b57b0f132e940f32551_JaffaCakes118.apk
Size

432KB
MD5

3738079a19b26b57b0f132e940f32551
SHA1

ad74963a4ba6e5075157cd2be089c35693153d55
SHA256

96e9077187317b26889fe9a6c765f57f2029a36bf288455ae35d4276581a86b7
SHA512

197621da3e68ad91c3f7ef38f74e6949ea5f108ff95a6fcafba486d9aaceb491e58bbd5dc2a3e91567f4b26cf81187db34ac391b8c0942be3586752cc02aefd7
SSDEEP

12288:IcRJ3KsX7N0HgSziADpDwQtUHFYo1lCYI8akScVEOZnpC6:NrKisiobMxPDakSc3ZnpC6

Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Signatures

XLoader payload 1 IoCs

Processes:

resource	yara_rule
/data/data/com.telw.qzkg/files/dex	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.telw.qzkg

pid process

5086 com.telw.qzkg
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.telw.qzkg

ioc pid process

/data/user/0/com.telw.qzkg/files/dex 5086 com.telw.qzkg
/data/user/0/com.telw.qzkg/files/dex 5086 com.telw.qzkg
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.telw.qzkg

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.telw.qzkg
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.telw.qzkg

description ioc process

Framework service call android.accounts.IAccountManager.getAccounts com.telw.qzkg
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads the content of the MMS message. 1 TTPs 1 IoCs
collection

SMS Messages
T1636.004

Processes:

com.telw.qzkg

description ioc process

URI accessed for read content://mms/ com.telw.qzkg
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.telw.qzkg

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.telw.qzkg
Acquires the wake lock 1 IoCs

Processes:

com.telw.qzkg

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.telw.qzkg
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.telw.qzkg

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.telw.qzkg
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.telw.qzkg

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.telw.qzkg

pid	process
5086	com.telw.qzkg

ioc	pid	process
/data/user/0/com.telw.qzkg/files/dex	5086	com.telw.qzkg
/data/user/0/com.telw.qzkg/files/dex	5086	com.telw.qzkg

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.telw.qzkg

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccounts	com.telw.qzkg

description	ioc	process
URI accessed for read	content://mms/	com.telw.qzkg

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.telw.qzkg

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.telw.qzkg

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.telw.qzkg

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.telw.qzkg

com.telw.qzkg
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5086

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Protected User Data

1

T1636

SMS Messages

1

T1636.004

Stored Application Data

1

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.telw.qzkg/files/dex
Filesize
766KB

MD5
a94e56982fdbb56095f2063d0560021b

SHA1
1366dc9b7351a298c3deec87783c0bb9e7d41e0b

SHA256
9e7bf9d8214a0f1f3d91f0740ff7b8ee90100ed05fa1a21f2c03e1569e2fa540

SHA512
f9715e2296319815495ffff4281eb4d53866fd0ababda1d32a507539d3ce06f673664e37466282ccbdd797c778c7ffa09d3046e21fba6fbf2c2bc2c35b470855

Download Submit
/data/data/com.telw.qzkg/files/oat/dex.cur.prof
Filesize
1KB

MD5
394c21c4d27d9d5bce636ee4bcc177ab

SHA1
0af8dfe55e7f6bda267ec8c170b42ad31dda79dc

SHA256
7cfc469bb24501175607322c1c49a1d5cc34dc3956538ecad71aea7cd11c0092

SHA512
5ab066fc6fc7577175a20e7e208d678f3573fa15420d9c565da6c2e10e2c5d3d9e9c6f83a044cb123f1e322b8f4957198f9f912320837ac21573202663fc5969

Download Submit

Analysis

Sharing