Analysis
-
max time kernel
179s -
max time network
187s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
-
submitted
14/06/2024, 00:05
General
-
Target
526edbd1b2f2e32d135963fd3bb48a52a46a6c822f209eef6439b903edd73508.apk
-
Size
217KB
-
MD5
60cb9cd0f871e3b9822c9af589ad0e1f
-
SHA1
925dcd77f58ee7af4f53caadceddc44697b041af
-
SHA256
526edbd1b2f2e32d135963fd3bb48a52a46a6c822f209eef6439b903edd73508
-
SHA512
f0b699448912caf1ca00e6d5926b01134e88b0a2a35e5ed07f6255deada31e1d08ce302419104ced0c526050c776463f638f4ad1f4fe20893536240dca7afad3
-
SSDEEP
6144:EZVyr5jYihhPyjYPtpS4OjVIFsbMtw1TvoSu:eVkYihPjzWjVIFsbFrdu
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 2 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
zxtj.uvxrh.pomjs1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD56e3d29b5306a57dba7028a8da4609797
SHA1da143c2306182d664c850b74b4afa7fa948c974d
SHA25607f170fb70397d72a187bcdb83adc11f2e7c6d5a928d951d4f24b5e82dc04d96
SHA512e9dadbc1fa4244e681a22178a512bf8ef0b5a41e6b80e54f09ef8f5fd120ac25c55db8a6ff53f748ba0ba22eeee84eb8714bc79468da921d4ec8f0129bd60915
-
Filesize
1KB
MD5bd2f38ab0cc4a4fc2dd278f6b60dcaf5
SHA12a4cb93b882514ab161af819380bbc9f84fa925e
SHA2564f8ea7690b6151f6867f16629b6ea58572f2ac9275a9d2e0ee0d6b7c141ab160
SHA51287ef034d897801916aeb28db865e94f81b2d7e74b877b04c68bfa54160ab4a9e523490f835bb375837f77e2e6038e9b851068f856ee53e62e98bdbd1ba7bbf2b
-
Filesize
36B
MD553041d3b3ff26ba25167c2ee2932c043
SHA11ab76d02b2e61ac8dfb02a1f19f06f24fa032db0
SHA256c4558f9aa75ca73a83567fc6b752ff0bff7466a679c887df5eea372575593129
SHA512abe9ba3edf78948414ff22b62bd311220ab52b24499b18af0395d8ee1d02c7c005f2244b756dbedcbec6c3e6efb4b6c835e5b78c0f7408e8e2bfb5f2673ab578