Analysis
-
max time kernel
179s -
max time network
172s -
platform
android_x64 -
resource
android-33-x64-arm64-20240514-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system -
submitted
30/05/2024, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
0d8c39f587f98a405c7dbb02f6a46dc856ad4b24ff385c478de89c39e4ea76ec.apk
Resource
android-33-x64-arm64-20240514-en
General
-
Target
0d8c39f587f98a405c7dbb02f6a46dc856ad4b24ff385c478de89c39e4ea76ec.apk
-
Size
278KB
-
MD5
3c97d7099516a6f62179c0d775c1eefd
-
SHA1
d26e69c50a68010d092c8d620bee184fbc183450
-
SHA256
0d8c39f587f98a405c7dbb02f6a46dc856ad4b24ff385c478de89c39e4ea76ec
-
SHA512
2985419f0d4377d90a4a71aec0fb3e03a944ddaca5dcb38ab7c121e32cab525e41dcb96ec352bcc349c5bd98782db46d6af4ef5b3361a60c839a7be728087cbf
-
SSDEEP
6144:sQvSjB6WhOxaPtVfoVj2WqW5TKpC6y6DSent7gtpS85N5rNk6:xvSjJqkojJY4yDp7g7SQhNk6
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 1 IoCs
resource yara_rule behavioral1/memory/4297-0.dex family_xloader_apk2 -
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
ioc Process /system/bin/su xf.aotog.mtrwm.irw -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/xf.aotog.mtrwm.irw/files/b 4297 xf.aotog.mtrwm.irw -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground xf.aotog.mtrwm.irw -
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccountsAsUser xf.aotog.mtrwm.irw -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/raw_contacts xf.aotog.mtrwm.irw -
Reads the content of the MMS message. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://mms/ xf.aotog.mtrwm.irw -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock xf.aotog.mtrwm.irw -
Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo xf.aotog.mtrwm.irw -
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS xf.aotog.mtrwm.irw -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal xf.aotog.mtrwm.irw
Processes
-
xf.aotog.mtrwm.irw1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Checks if the internet connection is available
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4297
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
492KB
MD57e1b639338295aaf9149d4d5cc496ed6
SHA1d89b93d56bf924551e6b421234179fd4fec859f9
SHA25602fcb596708bde924cdf258495deeb6cdb5a8016d01eff81f1b3ae449c2465fa
SHA512699ae0b027bce12865a1db5890ab38f79b22fa4b64e4739316e50e0f73e0c399ab2d4a2bc939b66b53796b821326e66822ef9102c3bce9b8e3854cabb1fa356f
-
Filesize
36B
MD544f099f5f703ab2318b2da62a25ee933
SHA129749abf263de0f980e74fd94ed6a3e06f6f7530
SHA256240b5f2a2fd14eadde1bc57523cc37c18361bdd382cd2edcac83be1923c9b0e2
SHA5122f0b2ab2426fd65adb16855a51633db26d2545550e610e102d8aacd206023a67ea78128cefdad15133bcebe41781c9783662c61bc851cfa60bd12a634d58e594