xloader_apk | d32e5937bd9004841cd8f1d1a3a111f68ed50e31c36d69b597605d5010a41a8b

Analysis

max time kernel
179s
max time network
187s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
19-05-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d32e5937bd9004841cd8f1d1a3a111f68ed50e31c36d69b597605d5010a41a8b.apk
Size

688KB
MD5

9eeb501549f9269ef1245bb133990a0b
SHA1

dd17da6985ecf0bc35c2685aae8aca0f0b118564
SHA256

d32e5937bd9004841cd8f1d1a3a111f68ed50e31c36d69b597605d5010a41a8b
SHA512

5e7d39cc17fd09a32aa83a18adff96aa13108c4c320a3d6c505215bcbb3cd37a5520b6221263c7499439e7dc81a2c1e08f3b532f6b5c78586e89831225e177f6
SSDEEP

12288:APzD902WkHg2Xqbliv261X2HQQQBK2ulkNNAzhWs78hZPBkGulaR1q1mtmj:APzD903MXuI+61X2HQLE2SkUzcswPAae

Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

Malware Config

Extracted

Family

xloader_apk

http://91.204.227.39:28844

DES_key

Signatures

XLoader payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/bpri.yskrj.vkknz/files/dex	family_xloader_apk
/data/user/0/bpri.yskrj.vkknz/files/dex	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Checks if the Android device is rooted. 1 TTPs 1 IoCs
evasion

T1426

Processes:

bpri.yskrj.vkknz

ioc process

/system/bin/su bpri.yskrj.vkknz
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

bpri.yskrj.vkknz

pid process

4640 bpri.yskrj.vkknz
Requests changing the default SMS application. 2 TTPs 1 IoCs
collection impact

T1636.004

T1582

Processes:

bpri.yskrj.vkknz

description ioc process

Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT bpri.yskrj.vkknz
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

bpri.yskrj.vkknz

ioc pid process

/data/user/0/bpri.yskrj.vkknz/files/dex 4640 bpri.yskrj.vkknz
/data/user/0/bpri.yskrj.vkknz/files/dex 4640 bpri.yskrj.vkknz
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

bpri.yskrj.vkknz

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground bpri.yskrj.vkknz
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

bpri.yskrj.vkknz

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser bpri.yskrj.vkknz
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Reads the content of the MMS message. 1 TTPs 1 IoCs
collection

T1636.004

Processes:

bpri.yskrj.vkknz

description ioc process

URI accessed for read content://mms/ bpri.yskrj.vkknz
Acquires the wake lock 1 IoCs

Processes:

bpri.yskrj.vkknz

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock bpri.yskrj.vkknz
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

bpri.yskrj.vkknz

description ioc process

Framework API call javax.crypto.Cipher.doFinal bpri.yskrj.vkknz

ioc	process
/system/bin/su	bpri.yskrj.vkknz

pid	process
4640	bpri.yskrj.vkknz

description	ioc	process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	bpri.yskrj.vkknz

ioc	pid	process
/data/user/0/bpri.yskrj.vkknz/files/dex	4640	bpri.yskrj.vkknz
/data/user/0/bpri.yskrj.vkknz/files/dex	4640	bpri.yskrj.vkknz

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	bpri.yskrj.vkknz

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	bpri.yskrj.vkknz

description	ioc	process
URI accessed for read	content://mms/	bpri.yskrj.vkknz

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	bpri.yskrj.vkknz

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	bpri.yskrj.vkknz

bpri.yskrj.vkknz
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Requests changing the default SMS application.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/bpri.yskrj.vkknz/files/dex
Filesize
456KB

MD5
c5654523e4899cf11630fe902e74b494

SHA1
d51781ac831b0442d5aaa8fb801d664f0daeb1c4

SHA256
fd7e515d5732df7cc5632a8411671fdad79815c7df963ef68f728398c8c8db31

SHA512
19e1fdb04673dec606e0376b0ffb4e32bd12d37cf50d22815c114ccc2a76824b114835ef858e0fbc84d89dc6be1e1951be047e24521771c05d6ce43fac137bdb

Download Submit
/data/user/0/bpri.yskrj.vkknz/files/oat/dex.cur.prof
Filesize
912B

MD5
b93442c50e8c1d456645bcc2dd7bd301

SHA1
2dbd9d0524dcee6dfdbe00dbaee15d7a3b907088

SHA256
79ce6f3b7c605f93cddcef9c50fb74230c32367481a7d6e92d84661ac7cfbf60

SHA512
ee59b0e6b8b399e61d124edf355ff9b8e4f05d4468da33dea387d861742cac3a7ff30924edc3bf532b4d2f1ab3b5336c9b58066661a1f0fda4239f2315b56c01

Download Submit
/storage/emulated/0/.msg_device_id.txt
Filesize
36B

MD5
a0d654d0de7eff8f309fc8e8fb4662ff

SHA1
1d1e905913843461c4310b39eb7c4f9c3b7e394c

SHA256
eb5700faa32be9b15f2dfd0f404d3b9f4872f4e71dceff80407a75b3409e8fb6

SHA512
3ecf4d3a8e760a80ee7efcfc8fc93be9235312ff83145535c82d53f065b5d413615630e48e1217fd8618ae30bd24458996313dd4aca8829385aa852cfdf8de39

Download Submit