Overview

overview

10

Static

static

6

9aed708629...18.apk

android-9-x86

10

9aed708629...18.apk

android-10-x64

10

9aed708629...18.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9aed708629b843558a023c07d82ceaa2_JaffaCakes118

  • Size

    388KB

  • Sample

    240610-rf4jrayhkn

  • MD5

    9aed708629b843558a023c07d82ceaa2

  • SHA1

    3f2c439b8cc2baf0d7fde2574a434b36f3991395

  • SHA256

    f8fea0a4a3a0494ff4c38be25754dc27275c68dc6672dbee239a8752c4e6f30d

  • SHA512

    ca0ffb5fabcb4a135a94e8a75744a46a777e9ff9eb78e4862b9b0986e3ab827bebb00d50f1419d40ea64fc693a0db62950f361741bf2758c5dfa3d43c5d89a0b

  • SSDEEP

    12288:8CRtMWnGhxTj5Vugdl8Q6ODaD4hDyosaiQjXWD:RwhR5VugkD4hdpQ

Score
10/10
xloader_apkandroidbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Targets

    • Target

      9aed708629b843558a023c07d82ceaa2_JaffaCakes118

    • Size

      388KB

    • MD5

      9aed708629b843558a023c07d82ceaa2

    • SHA1

      3f2c439b8cc2baf0d7fde2574a434b36f3991395

    • SHA256

      f8fea0a4a3a0494ff4c38be25754dc27275c68dc6672dbee239a8752c4e6f30d

    • SHA512

      ca0ffb5fabcb4a135a94e8a75744a46a777e9ff9eb78e4862b9b0986e3ab827bebb00d50f1419d40ea64fc693a0db62950f361741bf2758c5dfa3d43c5d89a0b

    • SSDEEP

      12288:8CRtMWnGhxTj5Vugdl8Q6ODaD4hDyosaiQjXWD:RwhR5VugkD4hdpQ

    Score
    10/10
    xloader_apkbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

      trojaninfostealerbankerxloader_apk

    • Checks if the Android device is rooted.

      evasion

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Queries the phone number (MSISDN for GSM devices)

      discovery

    • Reads the content of the MMS message.

      collection

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks