Analysis Overview

score

10^/10

SHA256

08d57e567dd1e974b857bc34a0e7ffb5466b209fd1397c6b39af72003a7c5814

Threat Level: Known bad

The file 08d57e567dd1e974b857bc34a0e7ffb5466b209fd1397c6b39af72003a7c5814.bin was found to be: Known bad.

Malicious Activity Summary

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

XLoader payload

XLoader, MoqHao

Checks if the Android device is rooted.

Removes its main activity from the application launcher

Queries account information for other applications stored on the device

Reads the content of the MMS message.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Loads dropped Dex/Jar

Queries the phone number (MSISDN for GSM devices)

Requests changing the default SMS application.

Requests dangerous framework permissions

Queries the unique device ID (IMEI, MEID, IMSI)

Acquires the wake lock

Makes use of the framework's foreground persistence service

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 00:08

Signatures

Requests dangerous framework permissions

Description	Indicator	Process	Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW	N/A	N/A
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS	N/A	N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE	N/A	N/A
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE	N/A	N/A
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE	N/A	N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE	N/A	N/A
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS	N/A	N/A
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS	N/A	N/A
Allows an application to read SMS messages.	android.permission.READ_SMS	N/A	N/A
Allows an application to send SMS messages.	android.permission.SEND_SMS	N/A	N/A
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 00:08

Reported

2024-06-14 00:11

Platform

android-x86-arm-20240611.1-en

Max time kernel

179s

Max time network

184s

Command Line

ekja.tisub.ucaqe

Signatures

XLoader payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion

Description	Indicator	Process	Target
N/A	/system/bin/su	N/A	N/A
N/A	/system/xbin/su	N/A	N/A
N/A	/sbin/su	N/A	N/A

Removes its main activity from the application launcher

stealth trojan evasion

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Loads dropped Dex/Jar

evasion

Description	Indicator	Process	Target
N/A	/data/user/0/ekja.tisub.ucaqe/files/dex	N/A	N/A
N/A	/data/user/0/ekja.tisub.ucaqe/files/dex	N/A	N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries account information for other applications stored on the device

collection

Description	Indicator	Process	Target
Framework service call	android.accounts.IAccountManager.getAccounts	N/A	N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection

Description	Indicator	Process	Target
URI accessed for read	content://mms/	N/A	N/A

Acquires the wake lock

Description	Indicator	Process	Target
Framework service call	android.os.IPowerManager.acquireWakeLock	N/A	N/A

Makes use of the framework's foreground persistence service

evasion persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.setServiceForeground	N/A	N/A

Requests changing the default SMS application.

collection impact

Description	Indicator	Process	Target
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	N/A	N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.registerReceiver	N/A	N/A

Uses Crypto APIs (Might try to encrypt user data)

impact

Description	Indicator	Process	Target
Framework API call	javax.crypto.Cipher.doFinal	N/A	N/A

Processes

ekja.tisub.ucaqe

Network

Country	Destination	Domain	Proto
N/A	224.0.0.251:5353		udp
US	1.1.1.1:53	docs.google.com	udp
GB	216.58.212.206:443	docs.google.com	tcp
GB	216.58.212.206:443	docs.google.com	tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
GB	142.250.187.206:443		tcp
US	1.1.1.1:53	android.apis.google.com	udp
GB	142.250.187.206:443	android.apis.google.com	tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
GB	172.217.169.10:443		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp

Files

/data/data/ekja.tisub.ucaqe/files/dex

MD5	8c7542abcfd5e2c08e99555d8d0bc605
SHA1	5f40007a5343603be18a1ce3c39ce43604099be5
SHA256	0cd2b17aa21cd8de63842da21e3464df7bb2bd4a278fffbbfea6b294c3ca9e6d
SHA512	362c7dd23aa52a9c72e9d90eebb99e1d4e4cd01b68348249bbeee4bb407728aabd30874488926635bacb2e1d640ad4e95852e345afa8ad66057c80c8f768ed88

/storage/emulated/0/.msg_device_id.txt

MD5	9274ea2a094025783d7b925cff6a3a68
SHA1	90a85a97e72e604afddad596f5dc93f2a7fa6b8c
SHA256	8775f85cb84bcb7a7f5d972b1401eb53625fd6bdfe0e0c66f968f59cb9de678c
SHA512	9c195566a3bdd4c1a00034453af6510d13ec720680e0dbb57719c5a1013cf7628fb499da9317dc44d13bb349dea92281dcf62b47bf329426ef557d249ca65899

/data/data/ekja.tisub.ucaqe/files/oat/dex.cur.prof

MD5	51445761fa642bbc82ee320e0cb59c57
SHA1	2124ae73057971bb6417db446650495a58174cbd
SHA256	38275aaa5a4b00b06f024f64aeab3a7ebb36894f704b13d666472d1c61871576
SHA512	5f5620f76a999e02f68f3110bd6ef790e28fbb66caf22bd00c4640b2c7e47a9ae56d51622132effca6a25b55fe11055d3124e6c67d9a4451c0240b460151f2f1

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 00:08

Reported

2024-06-14 00:11

Platform

android-x64-20240611.1-en

Max time kernel

179s

Max time network

188s

Command Line

ekja.tisub.ucaqe

Signatures

XLoader payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion

Description	Indicator	Process	Target
N/A	/system/bin/su	N/A	N/A
N/A	/system/xbin/su	N/A	N/A
N/A	/sbin/su	N/A	N/A

Removes its main activity from the application launcher

stealth trojan evasion

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Loads dropped Dex/Jar

evasion

Description	Indicator	Process	Target
N/A	/data/user/0/ekja.tisub.ucaqe/files/dex	N/A	N/A
N/A	/data/user/0/ekja.tisub.ucaqe/files/dex	N/A	N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries account information for other applications stored on the device

collection

Description	Indicator	Process	Target
Framework service call	android.accounts.IAccountManager.getAccounts	N/A	N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection

Description	Indicator	Process	Target
URI accessed for read	content://mms/	N/A	N/A

Acquires the wake lock

Description	Indicator	Process	Target
Framework service call	android.os.IPowerManager.acquireWakeLock	N/A	N/A

Makes use of the framework's foreground persistence service

evasion persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.setServiceForeground	N/A	N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.registerReceiver	N/A	N/A

Uses Crypto APIs (Might try to encrypt user data)

impact

Description	Indicator	Process	Target
Framework API call	javax.crypto.Cipher.doFinal	N/A	N/A

Processes

ekja.tisub.ucaqe

Network

Country	Destination	Domain	Proto
N/A	224.0.0.251:5353		udp
GB	142.250.187.227:443		tcp
US	1.1.1.1:53	docs.google.com	udp
GB	142.250.187.238:443	docs.google.com	tcp
GB	142.250.187.238:443	docs.google.com	tcp
KR	91.204.227.39:28844		tcp
US	1.1.1.1:53	ssl.google-analytics.com	udp
GB	216.58.204.72:443	ssl.google-analytics.com	tcp
GB	172.217.169.10:443		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
US	1.1.1.1:53	android.apis.google.com	udp
GB	142.250.179.238:443	android.apis.google.com	tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
GB	172.217.169.78:443		tcp
GB	142.250.179.226:443		tcp
GB	172.217.169.42:443		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
GB	142.250.187.196:443		tcp
GB	142.250.187.196:443		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
GB	172.217.169.14:443		tcp
GB	172.217.169.74:443		tcp
GB	172.217.169.74:443		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp

Files

/data/data/ekja.tisub.ucaqe/files/dex

MD5	8c7542abcfd5e2c08e99555d8d0bc605
SHA1	5f40007a5343603be18a1ce3c39ce43604099be5
SHA256	0cd2b17aa21cd8de63842da21e3464df7bb2bd4a278fffbbfea6b294c3ca9e6d
SHA512	362c7dd23aa52a9c72e9d90eebb99e1d4e4cd01b68348249bbeee4bb407728aabd30874488926635bacb2e1d640ad4e95852e345afa8ad66057c80c8f768ed88

/storage/emulated/0/.msg_device_id.txt

MD5	dff7b08b244e5a61cd083878188c0824
SHA1	8eac6238a477db0ca4a7f7ac725143df645de595
SHA256	55c883d1203ab1e635f55644a9eb28bc2edf6c6ce67eba42299fd78f4bc89ad8
SHA512	e680c3190b532700ef543f96f7cac84195a7aeece67f81bd531d29c73be548381e72a1cf97779dc34fa6776507eef2165cccef6469f94886f0fe3fa74610d130

/data/data/ekja.tisub.ucaqe/files/oat/dex.cur.prof

MD5	6ff34b147300349e7896e476b44c734a
SHA1	012e889f5e3ee64d2b14782fe4d31e060bdd545d
SHA256	9873f62bbeb9c28e79757aec3821e872ce581bc88630046c93b16ce965169bf2
SHA512	b8df032a7302968ce98bbab99f3d092f7160dafe6bcb8d16a6fb2df3c169830cadb5f3946f6ad7cb30c09ac2b2d4089cb315031bbeeffcd14e1965c2e8958b2e

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-14 00:08

Reported

2024-06-14 00:11

Platform

android-x64-arm64-20240611.1-en

Max time kernel

179s

Max time network

187s

Command Line

ekja.tisub.ucaqe

Signatures

XLoader payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion

Description	Indicator	Process	Target
N/A	/system/bin/su	N/A	N/A

Removes its main activity from the application launcher

stealth trojan evasion

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Loads dropped Dex/Jar

evasion

Description	Indicator	Process	Target
N/A	/data/user/0/ekja.tisub.ucaqe/files/dex	N/A	N/A
N/A	/data/user/0/ekja.tisub.ucaqe/files/dex	N/A	N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries account information for other applications stored on the device

collection

Description	Indicator	Process	Target
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	N/A	N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection

Description	Indicator	Process	Target
URI accessed for read	content://mms/	N/A	N/A

Acquires the wake lock

Description	Indicator	Process	Target
Framework service call	android.os.IPowerManager.acquireWakeLock	N/A	N/A

Makes use of the framework's foreground persistence service

evasion persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.setServiceForeground	N/A	N/A

Requests changing the default SMS application.

collection impact

Description	Indicator	Process	Target
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	N/A	N/A

Uses Crypto APIs (Might try to encrypt user data)

impact

Description	Indicator	Process	Target
Framework API call	javax.crypto.Cipher.doFinal	N/A	N/A

Processes

ekja.tisub.ucaqe

Network

Country	Destination	Domain	Proto
GB	172.217.16.238:443		tcp
N/A	224.0.0.251:5353		udp
GB	172.217.16.238:443		tcp
US	1.1.1.1:53	docs.google.com	udp
GB	142.250.179.238:443	docs.google.com	tcp
GB	142.250.179.238:443	docs.google.com	tcp
US	1.1.1.1:53	ssl.google-analytics.com	udp
GB	172.217.169.8:443	ssl.google-analytics.com	tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
GB	172.217.169.68:443		tcp
GB	172.217.169.68:443		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp
KR	91.204.227.39:28844		tcp

Files

/data/user/0/ekja.tisub.ucaqe/files/dex

MD5	8c7542abcfd5e2c08e99555d8d0bc605
SHA1	5f40007a5343603be18a1ce3c39ce43604099be5
SHA256	0cd2b17aa21cd8de63842da21e3464df7bb2bd4a278fffbbfea6b294c3ca9e6d
SHA512	362c7dd23aa52a9c72e9d90eebb99e1d4e4cd01b68348249bbeee4bb407728aabd30874488926635bacb2e1d640ad4e95852e345afa8ad66057c80c8f768ed88

/storage/emulated/0/.msg_device_id.txt

MD5	cc6b1f371fa3967ee9643b4e0fa96d37
SHA1	98c32ab305bf2eee1c60a408c84d83720fbdab0f
SHA256	0e0b1462b16103f2b69ae171199280bec88a0aa57963a5b5ae7c0e71740a99e1
SHA512	e7cbd021f111b3d5ff307603dbb747101ba62086a40960e3a186783bbf4e77e787c95df8638a39fc80374f2851a4ee68f305b6f234d4724605c74688860e5403

/data/user/0/ekja.tisub.ucaqe/files/oat/dex.cur.prof

MD5	f750bd8896af8ce757b1b4f9e336383e
SHA1	2eb1ad4c117dab216fbbd43e6f5600b935173838
SHA256	b19b914cb7a2996bbb32138207b470a4c2f886e220a0b3b5f0a46292d4959539
SHA512	fa54f7f2533e6a1489418ba1bac3ad0883b9f27c601b0702a02935ebb3dcbd6ada7225c92fa1d63062ac970297ded42889eaf1837fd6564eb29aed8746871896

Sample ID	240614-ae6t2s1anm
Target	08d57e567dd1e974b857bc34a0e7ffb5466b209fd1397c6b39af72003a7c5814.bin
SHA256	08d57e567dd1e974b857bc34a0e7ffb5466b209fd1397c6b39af72003a7c5814
Tags	xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

Malware Analysis Report

2024-07-28 11:33

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files