Analysis
-
max time kernel
179s -
max time network
184s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
16-06-2024 00:17
General
-
Target
58638c766713ebf4e438caae2c2a8742f5643e21b9aff95a479e7785b296f9ae.apk
-
Size
412KB
-
MD5
4d7556e480d1c76a483d6d1d98775a96
-
SHA1
14e63efb0cd8365fb78f57d97b4003a9f9e2b79b
-
SHA256
58638c766713ebf4e438caae2c2a8742f5643e21b9aff95a479e7785b296f9ae
-
SHA512
1d6531376fbd15773bf69caa51c43e6090837758e3d109b4be4ecafeaa9c9efb4e1b3461533ec38e423a3e8e8f961a1f9dace26c8a57c9cfd64f753885e6cb79
-
SSDEEP
12288:m7RlScl3evk6OR7jwflvqn+9l8oywdgyf:wzlj60s9Z9Kof
Malware Config
Extracted
xloader_apk
http://91.204.227.50:28899
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
wyqnkmc.quujpaagr.ffllfv1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166KB
MD55fc60656ee2f4440b70e03cd15edbcd2
SHA1cd3d016c7ce676d6c279575dea3b7765f10919da
SHA256ad4db3f58a63b4a95c42b82c7993fd5e6d4ce0b548b10adedcbcdf3a42261a0d
SHA512001759fd6e3fc57a9c420925da30766de6f6f485372a228403603d2253674f69e5796a6d5dd884799f21fa4d02626a1deee117825e34f52ac3f248a60b4146ac
-
Filesize
446KB
MD54f4569db9ddb90b5f60c424621cf3a72
SHA163c79e63187921b33d30c66de3e791e3f51d746e
SHA25618c14954e985db1a807189513a739c2ccb9ad37bba6cc9f8a61f0c42edffda4c
SHA512cf1c150f19ccc58441ac38060fe80961bbc9ea575a69c4437bd04be7555b92a3422490a4358f720450492edf5780d3d76eed4e02493c184bb3f13a8ab5ec4929
-
Filesize
36B
MD57d6830d7a0ccf38ebe0b880251a72cfb
SHA1d441d00b7729c5144a8f6ef4a94540ff2441cb73
SHA256361ab2b678783450d10d397849405c5d1d6aac1f718a6aeeebf223a187fb34e6
SHA5121f10472c7505ae441b84b0b85dd87255402404ab1f6263fab3d160985c8c2443a8a31547ef412639f528d0a23de3f9dc8414ba995eb544b02a9091323fd3b412
