Analysis
-
max time kernel
179s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
30/05/2024, 02:22
General
-
Target
82c11a00f2e079bdb68f7c1238c10f0b_JaffaCakes118.apk
-
Size
436KB
-
MD5
82c11a00f2e079bdb68f7c1238c10f0b
-
SHA1
d15b5729a33b19cb55b91d8d897b7b4b321fa2d4
-
SHA256
0ccc765797fff0ebad6cd063db40e25259445f2a205b51de063b61054bc1037a
-
SHA512
4cbc43914a3b59de7ae1785b1a249e90453e5d7dff271f8f66e40fd676e1246d4e648eeeb75ed6e6c50468500e931c68802ca25dd5588a6290eb5283779b71d6
-
SSDEEP
12288:UOvpYeBsaKO6m+DeLXzGo/+MYmzUgyu+Z6cXf:dptsdO6m+DqD/Smzq7Zb
Malware Config
Extracted
xloader_apk
http://103.126.160.21:38866
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.ujda.zmes1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Requests changing the default SMS application.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Reads the content of the MMS message.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
-
ping -c 4 103.126.160.212⤵
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
766KB
MD5775c7f2c45475a912f6b199320e3cbd1
SHA1778578802bd028e201fc3a55c01de93f26ee2dde
SHA2565d197df4be551f05909cd286ee3f63de9fb503c22444e69091eb9c848f735424
SHA512116066d5c1da63a097e7f66f7a1f1549a0035d27c7878e98cabf9aa064bb2b72b3b91d9f3b04c68b963a1968f13d8cf2f898704262c564a89e7e2ac40135976d