Analysis
-
max time kernel
179s -
max time network
185s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
13-06-2024 03:31
General
-
Target
99739a51a86f16146dd087a07659311d4c1dc11c95ae1ba7352ba7e22bf903a9.apk
-
Size
440KB
-
MD5
b968760008feef0120d8e41ccab3bb78
-
SHA1
fa1d7aada512ac92e6c02ac3cc82952f6de2dfee
-
SHA256
99739a51a86f16146dd087a07659311d4c1dc11c95ae1ba7352ba7e22bf903a9
-
SHA512
1e56197bbd0d4a515539c5368a2777d8b45dfecd2f4d1afccd2b611f5ddd819b9e922ae8118e1c82770dd0c5f5c2ea1687e0d1daa9207f9dab59747f2f9ca158
-
SSDEEP
12288:0lm+9GN1lAcWyysVeDaNju9+HkAbtT4qLR:00+2Dys7udAbv
Malware Config
Extracted
xloader_apk
http://91.204.227.50:28899
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
qzxvpfq.dbukndwdt.uxvdqr1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
170KB
MD58cfb4f4111d9c7a73c3fdc5c9e0a0339
SHA1ccd76033fa897cb16f2b20976aa62cf1b981b33e
SHA2568e905d41be5a1c5aea42932bfe8cd1da3d9b3b7ab4143391bd609ccb1210b944
SHA5123699f24af3cfb60e9f55a98bf4127ab8bcf5a09e781c8f562d534b6e76e1c6afdae8d1985ee1d6bd6f18ddebcd4203d8841b1e7655738e373f4342f61b28016e
-
Filesize
444KB
MD55052e382193805f854a17470afdeadc8
SHA1e434b19018b8d0a14c3db4b47318a9e92e9f5148
SHA2566eac212f3e5d11281f0c7263e5795bd74241b233898280b8cb9479443747f52a
SHA512be6fde561141ceebed2f1c98c845fdf247b10aecd15698130bda158484f02309e336a57e1a19fc740137f919904f0c649fcfed6d659b53b0ae6e97aaf794cec7
-
Filesize
36B
MD5bad12c54b0237e5cf870be7ec4a79ce6
SHA1a09d52fb5bac769ff6bd6580c9cc8022ec85fb09
SHA256a071aea798e5318dd249788f8619b9071197f83a9257bd47db179c7ee60ad6e1
SHA512a3398c243e0825622c4f091dd3da85d97c25d2c4a52213b3da973abb8c1e95b94e56ee8dee71afeb52994ab4b5a402164ef0c953c2f8fa95fd75581f6a25eb3c
