Analysis
-
max time kernel
179s -
max time network
161s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
01-06-2024 00:11
General
-
Target
eb0af5098e78804a6f20ef77e9c2b0787cfd490f92014905cf8cd72d16546a62.apk
-
Size
313KB
-
MD5
29322811281a2cfc71ae978829e1ef7b
-
SHA1
b1225764a8f8b8115ec26ce3753422063e689db3
-
SHA256
eb0af5098e78804a6f20ef77e9c2b0787cfd490f92014905cf8cd72d16546a62
-
SHA512
7b8b9747d05b0869f17ad9464c4ecd7a5df5352e8652a1e43757b69992cca5170244c6e3de8187c97dbe38d533041659b1881a47bf432582e3d870be2977648f
-
SSDEEP
6144:nM5aR3mpFGfxP6rxekP1buDFh8NSGsYm9YuBvrjhx:M5aRKUZP5iQ5zT99xBvRx
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 2 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
pixr.cuvma.ycahb1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Requests changing the default SMS application.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Queries information about the current Wi-Fi connection
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
580KB
MD5f51fa0481451ad4df6c3686f2a41e29a
SHA1c38c35f5da0921eedeb256986fbd6bb00314ec0e
SHA2567a60fc73f461b0c1dfb9c9786b44abd00e1c2034440397019a5225631e4679e4
SHA512af7cbefadd5fce52a10daffb4073154dfab2240616669d3050910eb03a254a6d73932caf5db827fd12d35f217bc79e75524c81b41a7740e050468e37ff96efd9
-
Filesize
1KB
MD51aaa95174142b55d45ad7cef94d63055
SHA15eea77e1b418c72e2eea1d7f39c09bec3af2db22
SHA25670755e4d153c2ca643bf727bf4727630a15110a5cedf19042cc6a2b1e73f6e3b
SHA5121971111bb795b7904af5b55ab4aecb1784a45d5db7f1bc34dc5329783c07871f09074dc25d583e83d3447a82e4b26fe25a9b9d921264246b142475d7ea7e98e0
-
Filesize
36B
MD5b1255605e50c689da0c4ae0fe617376b
SHA183ca92ac7b2b42014e976be8bddb34a60108c0c6
SHA256e11e9ff696d03d7e596c5d776d422ef4679fdf97a1afecfc2faf36ada9c225f7
SHA512258c9799725873e146ef788f60eef8219af64f9db09f6ac6aa0492ecaf79365d2d5c01db90ddbcb4575a6cd4e1831a22d2801065ed8bd8f48bcbab9d243fc75a