Analysis
-
max time kernel
89s -
max time network
94s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
submitted
31/05/2024, 09:39
General
-
Target
cron.apk
-
Size
308KB
-
MD5
d1b689bf4f853ca28727db3fd7dd46a8
-
SHA1
d95a437cffadbfa5ea77e05a190c037ab831d01b
-
SHA256
deeef21d80d6005b64d8c36807cc479817d0737088b2437e21e9639f4a75cacf
-
SHA512
e597c6c552c16da19e94f701a8c5f12603a185550921b113d86814e6ef8782c75d593a762c8e2f1d9a2262f79df96192b104c5f83b18c7717dfd280f339c7c67
-
SSDEEP
6144:S7824JNzTMOVpPIddgQNoT948zpPxrnPif2Fa1tXnN/c5+5/:S7eBbedgQE48zlxrnPc2Fa1tXFc5+5/
Malware Config
Extracted
xloader_apk
http://1.171.162.250:33669/user_info_uploader
https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic
-
user_agent
Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.uveh.bola1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572KB
MD5e3c8db2847f2325c2ba52de79c90b0e4
SHA14f32e7e367b22247e1cbcfd347bc231029269420
SHA256a5fb4d92a41ee44a387d621543a1b9ffa9bc04d6201fee0458cfe21638a62173
SHA512d1764d880a6d2bf0bd44f695df586a140b7d8a240a5f76cf715bf53337135cf956af68b754563b48f8d25175044dc819fa7d988c5a68fde95b19ac8ad181a0ca
-
Filesize
1KB
MD59e4a56e6f14adeee7c98d23716184c4f
SHA1588016a05764e85a8025f395eb2d9f27206b27dc
SHA256ec04f6c61fc13a8f26938b771cac5a07dac2dc0e26cf6017cf4dbfa0355a566c
SHA512afde083c79fd06c69bed0096031e9d60346dfa90976dd37df0ddb7251b95b96507e2d97ed0a3ff79a7acd6bc05902ede151a3bc6063bdb5b51f353e4beb8dd4a