Analysis Overview

score

10^/10

SHA256

fac0c56f25e44b6c89ee442e9897aaa615ab0993fff28f12b78fd2ea40ec48f6

Threat Level: Known bad

The file fac0c56f25e44b6c89ee442e9897aaa615ab0993fff28f12b78fd2ea40ec48f6.bin was found to be: Known bad.

Malicious Activity Summary

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

XLoader payload

XLoader, MoqHao

Checks if the Android device is rooted.

Removes its main activity from the application launcher

Queries the phone number (MSISDN for GSM devices)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Reads the content of the MMS message.

Queries account information for other applications stored on the device

Loads dropped Dex/Jar

Reads information about phone network operator.

Acquires the wake lock

Makes use of the framework's foreground persistence service

Declares services with permission to bind to the system

Requests dangerous framework permissions

Requests disabling of battery optimizations (often used to enable hiding in the background).

Checks the presence of a debugger

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 02:26

Signatures

Declares services with permission to bind to the system

Description	Indicator	Process	Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE	N/A	N/A

Requests dangerous framework permissions

Description	Indicator	Process	Target
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE	N/A	N/A
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE	N/A	N/A
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS	N/A	N/A
Allows an application to read SMS messages.	android.permission.READ_SMS	N/A	N/A
Allows an application to send SMS messages.	android.permission.SEND_SMS	N/A	N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW	N/A	N/A
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS	N/A	N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE	N/A	N/A
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS	N/A	N/A
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS	N/A	N/A
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 02:26

Reported

2024-06-13 02:29

Platform

android-x86-arm-20240611.1-en

Max time kernel

179s

Max time network

184s

Command Line

jsgqgtb.jhbnyjuar.hfwbjh

Signatures

XLoader payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion

Description	Indicator	Process	Target
N/A	/system/bin/su	N/A	N/A
N/A	/system/xbin/su	N/A	N/A
N/A	/sbin/su	N/A	N/A

Removes its main activity from the application launcher

stealth trojan evasion

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Loads dropped Dex/Jar

evasion

Description	Indicator	Process	Target
N/A	/data/user/0/jsgqgtb.jhbnyjuar.hfwbjh/app_picture/1.jpg	N/A	N/A
N/A	/data/user/0/jsgqgtb.jhbnyjuar.hfwbjh/app_picture/1.jpg	N/A	N/A
N/A	/data/user/0/jsgqgtb.jhbnyjuar.hfwbjh/files/b	N/A	N/A
N/A	/data/user/0/jsgqgtb.jhbnyjuar.hfwbjh/files/b	N/A	N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries account information for other applications stored on the device

collection

Description	Indicator	Process	Target
Framework service call	android.accounts.IAccountManager.getAccounts	N/A	N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection

Description	Indicator	Process	Target
URI accessed for read	content://mms/	N/A	N/A

Acquires the wake lock

Description	Indicator	Process	Target
Framework service call	android.os.IPowerManager.acquireWakeLock	N/A	N/A

Makes use of the framework's foreground persistence service

evasion persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.setServiceForeground	N/A	N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion

Description	Indicator	Process	Target
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	N/A	N/A

Checks the presence of a debugger

evasion

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.registerReceiver	N/A	N/A

Uses Crypto APIs (Might try to encrypt user data)

impact

Description	Indicator	Process	Target
Framework API call	javax.crypto.Cipher.doFinal	N/A	N/A

Checks CPU information

Description	Indicator	Process	Target
File opened for read	/proc/cpuinfo	N/A	N/A

Processes

jsgqgtb.jhbnyjuar.hfwbjh

Network

Country	Destination	Domain	Proto
N/A	224.0.0.251:5353		udp
US	1.1.1.1:53	m.vk.com	udp
RU	87.240.132.78:443	m.vk.com	tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
GB	216.58.212.238:443		tcp
US	1.1.1.1:53	android.apis.google.com	udp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
US	1.1.1.1:53	android.apis.google.com	udp
GB	142.250.179.238:443	android.apis.google.com	tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp
KR	91.204.227.50:28899		tcp

Files

/data/data/jsgqgtb.jhbnyjuar.hfwbjh/app_picture/1.jpg

MD5	c5d60cc770abfcd4b06932f47cd33eb2
SHA1	0910b5d0e2d0bba9d4449b7ba6ef577a22a9ca49
SHA256	1572a975ed9f4450f0a8d3b049a4427d32abe0def960c79a86be76cc1c86cd38
SHA512	e6bf19508020bbbf2fa1399eadcbda39e66949118ea3ee5cd55d52f4918852d6bc7826cee885fc1e9453fcb2f34261d096276b4355e4d1e6b6043ff8b0a6cc3b

/data/data/jsgqgtb.jhbnyjuar.hfwbjh/files/b

MD5	5052e382193805f854a17470afdeadc8
SHA1	e434b19018b8d0a14c3db4b47318a9e92e9f5148
SHA256	6eac212f3e5d11281f0c7263e5795bd74241b233898280b8cb9479443747f52a
SHA512	be6fde561141ceebed2f1c98c845fdf247b10aecd15698130bda158484f02309e336a57e1a19fc740137f919904f0c649fcfed6d659b53b0ae6e97aaf794cec7

/storage/emulated/0/.msg_device_id.txt

MD5	8e255136e85e45792c7992cb28562c05
SHA1	a8e1f8591e150fb5dbe18cabb01a242ba19822ca
SHA256	9a40d3c2c7750c81b6420e7055e7ea4f9e6f61a3b329ec9e6da0a9e0705c8e7a
SHA512	25ade2fa41897cbfab752f970858f573cbc8d51dfd2dc00a88a9560974f4b5b99d55ea8b747609540db5047764e7ce260ef8ef45518ceb7bf075109b16ff3a0f

Malware Analysis Report

2024-07-28 11:35

Table of Contents