xloader_apk | 0585797034554d28f76324542e8b74f6cbb809127c1800169e2711266a812197

Analysis

max time kernel
179s
max time network
190s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
21-05-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0585797034554d28f76324542e8b74f6cbb809127c1800169e2711266a812197.apk
Size

206KB
MD5

cc67c5f5e4d99f40e7eb3922706ddcd7
SHA1

80f2fa242fe20ade4b20b46721b980bb3c4b3c91
SHA256

0585797034554d28f76324542e8b74f6cbb809127c1800169e2711266a812197
SHA512

19ffcc8a49c5fc4d700cf6e636cc2f6dbe72ea20d0312e2fe84787677755914584de1ad6644320b163386bf6078922900ac41e26dcbaad39ee4d14e43bf58c45
SSDEEP

3072:XGbH+roBoBKY7oupboIS0phUVCUDhBYMXasFYvXwvVQNPbfDBMipz6306sgONblo:X8+rUY7bczKvFTDn16PsgONBQ9v

Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

Malware Config

Extracted

Family

xloader_apk

http://91.204.227.39:28844

DES_key

Signatures

XLoader payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/pyga.smxoh.uhgyd/files/dex	family_xloader_apk
/data/user/0/pyga.smxoh.uhgyd/files/dex	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Checks if the Android device is rooted. 1 TTPs 1 IoCs
evasion

System Information Discovery
T1426

Processes:

pyga.smxoh.uhgyd

ioc process

/system/bin/su pyga.smxoh.uhgyd
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

pyga.smxoh.uhgyd

pid process

4637 pyga.smxoh.uhgyd
Requests changing the default SMS application. 2 TTPs 1 IoCs
collection impact

SMS Messages
T1636.004

SMS Control
T1582

Processes:

pyga.smxoh.uhgyd

description ioc process

Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT pyga.smxoh.uhgyd
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

pyga.smxoh.uhgyd

ioc pid process

/data/user/0/pyga.smxoh.uhgyd/files/dex 4637 pyga.smxoh.uhgyd
/data/user/0/pyga.smxoh.uhgyd/files/dex 4637 pyga.smxoh.uhgyd
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

pyga.smxoh.uhgyd

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground pyga.smxoh.uhgyd
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

pyga.smxoh.uhgyd

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser pyga.smxoh.uhgyd
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads the content of the MMS message. 1 TTPs 1 IoCs
collection

SMS Messages
T1636.004

Processes:

pyga.smxoh.uhgyd

description ioc process

URI accessed for read content://mms/ pyga.smxoh.uhgyd
Acquires the wake lock 1 IoCs

Processes:

pyga.smxoh.uhgyd

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock pyga.smxoh.uhgyd
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

pyga.smxoh.uhgyd

description ioc process

Framework API call javax.crypto.Cipher.doFinal pyga.smxoh.uhgyd

ioc	process
/system/bin/su	pyga.smxoh.uhgyd

pid	process
4637	pyga.smxoh.uhgyd

description	ioc	process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	pyga.smxoh.uhgyd

ioc	pid	process
/data/user/0/pyga.smxoh.uhgyd/files/dex	4637	pyga.smxoh.uhgyd
/data/user/0/pyga.smxoh.uhgyd/files/dex	4637	pyga.smxoh.uhgyd

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	pyga.smxoh.uhgyd

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	pyga.smxoh.uhgyd

description	ioc	process
URI accessed for read	content://mms/	pyga.smxoh.uhgyd

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	pyga.smxoh.uhgyd

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	pyga.smxoh.uhgyd

pyga.smxoh.uhgyd
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Requests changing the default SMS application.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4637

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

SMS Control

T1582

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/pyga.smxoh.uhgyd/files/dex
Filesize
456KB

MD5
a528b034f05069ba64c868aebe4667ea

SHA1
980b3bec0396befc4ae838feaf8c7fdcf827cce1

SHA256
4441dfe8763a31ee11bddeac399b41cd9f7cbe68afc7d67599d7dcc14460c6a4

SHA512
2165abe1cc38aec0f5d67f41bd4215f8a3b13b13aab590a4a7d75807f9a29a20d66eccc8056038a1fa05a5fba2ffe0b181f88d026584e6960b520289b726408b

Download Submit
/data/user/0/pyga.smxoh.uhgyd/files/oat/dex.cur.prof
Filesize
1KB

MD5
55e9b66b65e746e8483c302c971bc3e3

SHA1
a3feb218f05abe1aba35370ff10d12c2937d62da

SHA256
92fa9cded4a315dfd0038a1b50739d35841cdffd95057491c950f75c01ef9064

SHA512
4d2ab91928198ea0b1647190d91e3db03084c229fabfbe36041678f2cf0a47a67e5e4207835a84eddbc02aec01698ccb4db2201ae8f607a346f0bc90b040d3ab

Download Submit
/storage/emulated/0/.msg_device_id.txt
Filesize
36B

MD5
80337f2f70de6f21f5b0cea665762cb3

SHA1
aec6d4a1b5d5e0f0ea3d244c49aecde44570130f

SHA256
d3ffcc7f7e47141a63f7e1aa01c0b909285c66d91532137f12f08958e14b8839

SHA512
2d567d6b43bb039fc8b16b1a88e3aef2a37781aacbfee6707222b94cf926a531f4a7f4e73c8a71d337c5de65a8fb6e6d9e813ab072004fc875fba079e5220537

Download Submit