Malware Analysis Report

2024-09-09 13:22

Sample ID 240613-c8ghcsvgmj
Target d7a31acf075a014138a999952d4387d8e92c0cbecd2b0f132b8dafee15f39b4d.bin
SHA256 d7a31acf075a014138a999952d4387d8e92c0cbecd2b0f132b8dafee15f39b4d
Tags
xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d7a31acf075a014138a999952d4387d8e92c0cbecd2b0f132b8dafee15f39b4d

Threat Level: Known bad

The file d7a31acf075a014138a999952d4387d8e92c0cbecd2b0f132b8dafee15f39b4d.bin was found to be: Known bad.

Malicious Activity Summary

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

XLoader, MoqHao

XLoader payload

Checks if the Android device is rooted.

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries account information for other applications stored on the device

Reads the content of the MMS message.

Queries the phone number (MSISDN for GSM devices)

Requests dangerous framework permissions

Declares services with permission to bind to the system

Requests disabling of battery optimizations (often used to enable hiding in the background).

Reads information about phone network operator.

Acquires the wake lock

Makes use of the framework's foreground persistence service

Checks the presence of a debugger

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 02:44

Signatures

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application a broad access to external storage in scoped storage. android.permission.MANAGE_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 02:44

Reported

2024-06-13 02:47

Platform

android-x86-arm-20240611.1-en

Max time kernel

10s

Max time network

183s

Command Line

rnsmawz.jjbrogwam.xztnau

Signatures

XLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/bin/su N/A N/A
N/A /system/xbin/su N/A N/A
N/A /sbin/su N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/rnsmawz.jjbrogwam.xztnau/app_picture/1.jpg N/A N/A
N/A /data/user/0/rnsmawz.jjbrogwam.xztnau/app_picture/1.jpg N/A N/A
N/A /data/user/0/rnsmawz.jjbrogwam.xztnau/files/b N/A N/A
N/A /data/user/0/rnsmawz.jjbrogwam.xztnau/files/b N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccounts N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection
Description Indicator Process Target
URI accessed for read content://mms/ N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Checks the presence of a debugger

evasion

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

rnsmawz.jjbrogwam.xztnau

Network

Country Destination Domain Proto
GB 172.217.169.74:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 m.vk.com udp
RU 87.240.129.133:443 m.vk.com tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
RU 87.240.129.133:443 m.vk.com tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.169.46:443 android.apis.google.com tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
GB 172.217.169.74:443 tcp
GB 172.217.169.74:443 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp

Files

/data/data/rnsmawz.jjbrogwam.xztnau/app_picture/1.jpg

MD5 fe139636d02cb0063e6a1345e5bed025
SHA1 7f3f51c5d4d8ffad041bb7832174a8c96662050b
SHA256 e7a53c63f1b0ab536693248e8e19a8866f0bf11ca74ce4dd5c26b8d0d83e8aab
SHA512 eb07ffc6e3b3e1ecdd9aae4d8fb8a41ff0f6d1a68f546ad74d09086a5a71c107ce78e04dd1333db3da13c2872c7d56a958b47d5b6219afc0ad3f46e3916aaa4b

/data/user/0/rnsmawz.jjbrogwam.xztnau/app_picture/1.jpg

MD5 2a98698f460cc4135f26a674284fd385
SHA1 9dc335d1d7458d20ddaf5a951a21a6ada4b20f3d
SHA256 397509324452c7a5264d161d1422e9b1bf6ba1f4a8e92735d7c14fefbe3a1a5c
SHA512 5fa5598d14c40599347c59bc0d3ff303cf27aba01e75fb492626244194b0cff9c2d00fd5a09bb0333493ca70d02d07422ba15b2a80e080e469fb29d2424bd1f1

/data/data/rnsmawz.jjbrogwam.xztnau/files/b

MD5 5052e382193805f854a17470afdeadc8
SHA1 e434b19018b8d0a14c3db4b47318a9e92e9f5148
SHA256 6eac212f3e5d11281f0c7263e5795bd74241b233898280b8cb9479443747f52a
SHA512 be6fde561141ceebed2f1c98c845fdf247b10aecd15698130bda158484f02309e336a57e1a19fc740137f919904f0c649fcfed6d659b53b0ae6e97aaf794cec7

/storage/emulated/0/.msg_device_id.txt

MD5 dc38c73c1dc9b211c328e0a8e65c6ff9
SHA1 caa354b7a43b0a34ef2a5301466cfa0bbb84be1f
SHA256 94a705f5e3dc5999b742f964583993d98ae59600ec5800a3a82a736505fc6ff8
SHA512 bdbb29f56a5d2c92bf0069b3680ff3ddeab5b93a995db9ff97a545d7649e05189117bb87841de72408aca53a0cb27e59974fb74e9b5c7b6f76efe75d0a054f8c