Analysis
-
max time kernel
179s -
max time network
184s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
13-06-2024 01:14
General
-
Target
ef39fd17c1ac9a23f1d12caeff119f7b2d42d019287c2e3e4df5eabdc9a06caf.apk
-
Size
436KB
-
MD5
850e4f84fd5f7ce6fd08c685d332610a
-
SHA1
1bd076e7cef8a337ffca98ee02a591197d6d1e39
-
SHA256
ef39fd17c1ac9a23f1d12caeff119f7b2d42d019287c2e3e4df5eabdc9a06caf
-
SHA512
a408950d8135662feaeecff659002fdb0b18cacb7003ae9a9532353e84f4dd5c938873f613b285bcf8f5541e824420a97b79e15f05d50d75fd756dd05eefde77
-
SSDEEP
6144:GIIaQYiSWTql6+iK6edDusVeDaOJ3CBtKXyFju92/HAjjcJ1ttT6zziXXjhVmuP8:pAcWyysVeDaNju9+HkAbtT4qELHssQnS
Malware Config
Extracted
xloader_apk
http://91.204.227.50:28899
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
hknmbqk.ceplfqiis.cpvxwx1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5fe56f88f35ebef0235d3bd5b55002729
SHA156225874f4676d59598f8bfa71c0e7f51b398610
SHA25610a2682e4c3d2f0679cd6eb68cbf9f30ee1de7006196a2de3fcf7f9ee871c77b
SHA512f7a1a63ab6e1a303edce867d2cab338fe506731bc9b5c0a241a28aaefb36a2f8ac147ea43308db5bb51edd61e1035304afe5b9bdc112f7a7671e213bc6474b03
-
Filesize
444KB
MD55052e382193805f854a17470afdeadc8
SHA1e434b19018b8d0a14c3db4b47318a9e92e9f5148
SHA2566eac212f3e5d11281f0c7263e5795bd74241b233898280b8cb9479443747f52a
SHA512be6fde561141ceebed2f1c98c845fdf247b10aecd15698130bda158484f02309e336a57e1a19fc740137f919904f0c649fcfed6d659b53b0ae6e97aaf794cec7
-
Filesize
36B
MD564e9d29e37a80f5a0f37e2442956575d
SHA1a31a495764ae25c821c938d281a31c789a3cec59
SHA256000898e5b9ba19264099d4b57588ae39702ed6aefb860ed3942755909bd94ef2
SHA5120bbb5c9ed1cf0b9ac077f88d60a281f5cdb648be0ea56daed66b443a2170e2377a3959647b0a4286b561b7bc0fb4586bdfca808de36917bd8b0e7fcbe277911c
