Analysis
-
max time kernel
179s -
max time network
172s -
platform
android_x64 -
resource
android-33-x64-arm64-20240514-en -
resource tags
-
submitted
30/05/2024, 23:14
General
-
Target
0d8c39f587f98a405c7dbb02f6a46dc856ad4b24ff385c478de89c39e4ea76ec.apk
-
Size
278KB
-
MD5
3c97d7099516a6f62179c0d775c1eefd
-
SHA1
d26e69c50a68010d092c8d620bee184fbc183450
-
SHA256
0d8c39f587f98a405c7dbb02f6a46dc856ad4b24ff385c478de89c39e4ea76ec
-
SHA512
2985419f0d4377d90a4a71aec0fb3e03a944ddaca5dcb38ab7c121e32cab525e41dcb96ec352bcc349c5bd98782db46d6af4ef5b3361a60c839a7be728087cbf
-
SSDEEP
6144:sQvSjB6WhOxaPtVfoVj2WqW5TKpC6y6DSent7gtpS85N5rNk6:xvSjJqkojJY4yDp7g7SQhNk6
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
xf.aotog.mtrwm.irw1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Checks if the internet connection is available
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
492KB
MD57e1b639338295aaf9149d4d5cc496ed6
SHA1d89b93d56bf924551e6b421234179fd4fec859f9
SHA25602fcb596708bde924cdf258495deeb6cdb5a8016d01eff81f1b3ae449c2465fa
SHA512699ae0b027bce12865a1db5890ab38f79b22fa4b64e4739316e50e0f73e0c399ab2d4a2bc939b66b53796b821326e66822ef9102c3bce9b8e3854cabb1fa356f
-
Filesize
36B
MD544f099f5f703ab2318b2da62a25ee933
SHA129749abf263de0f980e74fd94ed6a3e06f6f7530
SHA256240b5f2a2fd14eadde1bc57523cc37c18361bdd382cd2edcac83be1923c9b0e2
SHA5122f0b2ab2426fd65adb16855a51633db26d2545550e610e102d8aacd206023a67ea78128cefdad15133bcebe41781c9783662c61bc851cfa60bd12a634d58e594