Analysis

  • max time kernel
    179s
  • max time network
    187s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    23-06-2024 00:49

General

  • Target

    ace62901f4fec709fce73f50ccf823c79fb191b7b40f32e7fa9b2d1012982871.apk

  • Size

    276KB

  • MD5

    ab381d86748442735a395bb66356db5c

  • SHA1

    ccb7af1cfb3427b99b407e306755c629d2221acb

  • SHA256

    ace62901f4fec709fce73f50ccf823c79fb191b7b40f32e7fa9b2d1012982871

  • SHA512

    07ae615fe92c275314c451f8cdec644bd6bbfe35baa4bf08a3ac245b76eb9ea989c2c0bf4c2baf9e676e3fb0785c59258922b3b04b090a9a4ebce80cb81debd7

  • SSDEEP

    6144:IU74o0OT7W1PRt5eU2/Ge97gW0a3fISi6uJq1SRNFA2fvx7WL944vQ:IY4oqj5vne9z0swSDuJq1SbFA2fvx7B5

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Signatures

Processes

  • com.wliz.yqcq
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5014

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.wliz.yqcq/files/dex

    Filesize

    484KB

    MD5

    70f95d8cbe97d5c2eba3ea8444ae66ab

    SHA1

    ceeb757ec23da7c6b127262ae1dd966b4a7a73cc

    SHA256

    b02e06dfd1642646e5ccf3a06ccfc850edd1ba0464550962a15e69a0b6931426

    SHA512

    666d43b00bb424631c17248ced477990e5d2375b9ca086aeaf976ec00c44d017ff8e72538afdaa26b918014451382c8462a84c37ad2a597e0ec1c39288c96efa

  • /data/data/com.wliz.yqcq/files/oat/dex.cur.prof

    Filesize

    1KB

    MD5

    b9868b8480c372cf44b7d9aaac176fbd

    SHA1

    3c03f092fd6b555837bcdbfe26f57d0c0be05c33

    SHA256

    51ee13434ab68d27367c54bf9e6fb29088d5149d762713125565b276c33c412c

    SHA512

    35b371cd107451edc2b04fdba9eaf8346f276d1d1226d0a928a272f0537f16775e04fa70c57f264f0d8d698f9d4cd3913f22003217b02bf753ec28d68b849f65