Analysis
-
max time kernel
179s -
max time network
164s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
-
submitted
29-05-2024 22:58
General
-
Target
f0a7bda1fcb7cad4e188361daeb1c03475ab8509fe64c55564c7ab1c898fd6b0.apk
-
Size
205KB
-
MD5
1c8ebe1833fb7124cdd98d893fe60dbc
-
SHA1
9fe0bcc0d5db3dab0d06ab72bb9730d145953730
-
SHA256
f0a7bda1fcb7cad4e188361daeb1c03475ab8509fe64c55564c7ab1c898fd6b0
-
SHA512
2f284f1a09b4c44deb6872a7376256892f383ac6d5ef41e1fd672a6f9d81280e6535449df2410de409e3f4a220ea750b195197bcdd0f8b1a41ddd14efe8f03b7
-
SSDEEP
6144:ShLOBUvNRUg7t1I4m9dSedICH8RWcZgd5otcC:O3vNaI1Iv2yZcZ+PC
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 2 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
lmeb.izvmr.bjgij1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Requests changing the default SMS application.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Queries information about the current Wi-Fi connection
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
454KB
MD5c908b637c002940ef72c0f34eda33115
SHA1c886b4786f696ca4be26516a83e842863e71f728
SHA256125b57669edb6060fea0e71718ea17c957186496c2c1ea010d95c64218fe31ae
SHA51257eafa70138d9b97af7c3160306133f1591f015563f4ebe21cb4a0354a6c2a380e246de64ea54d492e84d433b77b50d887ebdd3566002799abdeba66742ec350
-
Filesize
36B
MD5abbf275bad0c26b2f2e8c8d68c7c0fc8
SHA1c495702aafc0d66c3fb53e0d12a09b6bdaedfc2f
SHA256e916eaf60aa177f062a8694dcdd9d732bd81da93654f0e676391f4f22721a6f5
SHA512c176de23bff210cf0e7a7e26b234a847e4038757ed40414cf1722e55c640234af8ef02b60814855cca54ba9ed3561634b7ad4b101e696793e4685eab08d76612