General

  • Target

    437808d7d9f97e9f4dff211f72f0ae0be5d251a67a161628d5b533d465ad38bc.bin

  • Size

    217KB

  • Sample

    240514-1y672abb75

  • MD5

    c9e99613d473c9ca37f2c75aabb73965

  • SHA1

    9d9a95eef70d60d1b3f2e4b33b8f8a3950b63fa0

  • SHA256

    437808d7d9f97e9f4dff211f72f0ae0be5d251a67a161628d5b533d465ad38bc

  • SHA512

    a9985cf188bd305fbf76e34625256a4fc35bfeb0980977df6a3f996f54f45f4a30364bbbaca0dcad804fe6b851a7ec98f24e4650c4615de5a5b7a68c00675656

  • SSDEEP

    6144:sA0ChFhFBvrbvxB/XEwR/aJXyjt4k64W+U:ECLNvrLLESgXKDZfU

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Targets

    • Target

      437808d7d9f97e9f4dff211f72f0ae0be5d251a67a161628d5b533d465ad38bc.bin

    • Size

      217KB

    • MD5

      c9e99613d473c9ca37f2c75aabb73965

    • SHA1

      9d9a95eef70d60d1b3f2e4b33b8f8a3950b63fa0

    • SHA256

      437808d7d9f97e9f4dff211f72f0ae0be5d251a67a161628d5b533d465ad38bc

    • SHA512

      a9985cf188bd305fbf76e34625256a4fc35bfeb0980977df6a3f996f54f45f4a30364bbbaca0dcad804fe6b851a7ec98f24e4650c4615de5a5b7a68c00675656

    • SSDEEP

      6144:sA0ChFhFBvrbvxB/XEwR/aJXyjt4k64W+U:ECLNvrLLESgXKDZfU

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Removes its main activity from the application launcher

    • Requests changing the default SMS application.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries account information for other applications stored on the device

      Application may abuse the framework's APIs to collect account information stored on the device.

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Queries the unique device ID (IMEI, MEID, IMSI)

MITRE ATT&CK Matrix

Tasks