Malware Analysis Report

2024-07-28 11:26

Sample ID 240629-1y2mjsxdmb
Target ceb365c5e0f1c73afdbb892b75ffba264746c53b9a297c4d9455bab0f64824c5.bin
SHA256 ceb365c5e0f1c73afdbb892b75ffba264746c53b9a297c4d9455bab0f64824c5
Tags
xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ceb365c5e0f1c73afdbb892b75ffba264746c53b9a297c4d9455bab0f64824c5

Threat Level: Known bad

The file ceb365c5e0f1c73afdbb892b75ffba264746c53b9a297c4d9455bab0f64824c5.bin was found to be: Known bad.

Malicious Activity Summary

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

XLoader payload

XLoader, MoqHao

Checks if the Android device is rooted.

Removes its main activity from the application launcher

Queries account information for other applications stored on the device

Queries the phone number (MSISDN for GSM devices)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Loads dropped Dex/Jar

Reads the content of the MMS message.

Makes use of the framework's foreground persistence service

Declares services with permission to bind to the system

Acquires the wake lock

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests dangerous framework permissions

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-29 22:04

Signatures

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application a broad access to external storage in scoped storage. android.permission.MANAGE_EXTERNAL_STORAGE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-29 22:04

Reported

2024-06-29 22:25

Platform

android-x86-arm-20240624-en

Max time kernel

179s

Max time network

185s

Command Line

oxytxjq.uzfytssia.yxrhgs

Signatures

XLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/bin/su N/A N/A
N/A /system/xbin/su N/A N/A
N/A /sbin/su N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/oxytxjq.uzfytssia.yxrhgs/app_picture/1.jpg N/A N/A
N/A /data/user/0/oxytxjq.uzfytssia.yxrhgs/app_picture/1.jpg N/A N/A
N/A /data/user/0/oxytxjq.uzfytssia.yxrhgs/files/b N/A N/A
N/A /data/user/0/oxytxjq.uzfytssia.yxrhgs/files/b N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccounts N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection
Description Indicator Process Target
URI accessed for read content://mms/ N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

oxytxjq.uzfytssia.yxrhgs

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 m.vk.com udp
RU 93.186.225.194:443 m.vk.com tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp
KR 91.204.227.50:28899 tcp

Files

/data/data/oxytxjq.uzfytssia.yxrhgs/app_picture/1.jpg

MD5 4772e65e424d7fa395d50587b3e9d21a
SHA1 7b6bb9dc518a5b98621fc96ba72063fc4dc7b707
SHA256 d0a23f461e258fc9935913e84272c626351876760601ea424ec2ca40c77f0b79
SHA512 e0c3f7a0156f25a50d7e9cb70607e3e707d59362fb24868aab35579e74776b65bead02efd7d0bb23847acbeb5bf0b5847f461d581371046dfd32f6611ed56cb4

/data/user/0/oxytxjq.uzfytssia.yxrhgs/app_picture/1.jpg

MD5 0ccddab8a77d7da31f69d33952214e4a
SHA1 4e4966c32a15f1eebe5e84b33d5252505e3b9212
SHA256 9e0458d66fbe37af2aee8bfbd3efa05dbd3601876fcaf110bcc6b92e8440afb5
SHA512 4b0e2c45a966d80c7d855469aeafa5c08f62185e5195200427b39b913626a88d5a4e645e5990f46840de7f1366e4351ce6c4b559f98689be3a0f841b22b74939

/data/data/oxytxjq.uzfytssia.yxrhgs/files/b

MD5 5daa1f3756c6785b25d466ca6b7bdc50
SHA1 ad6a6880ad1b812434e5bd3b2c1717ba11b54cf6
SHA256 a1695cf685fbf9712a67bbc7f9bf82c6d6fe5f8ef185f1ede33fcb76526143c7
SHA512 2dbeab1cfd8658b6681d3bda791f2fd3f1199c9aee135b1baa1e91abf87d20de221eec1027f611356781b7c6dbb823b8b157509ced30b03a62f6842fbde0e7e9

/storage/emulated/0/.msg_device_id.txt

MD5 35ba312fa91a23c2c99d2ad69f9ffbd9
SHA1 f2652c2b6851b78964ac7469770d8ec397ab91d5
SHA256 03aa3d629f67a9d01880d57432ab8da42fbd6f14bc987c090b63d089f5b82601
SHA512 08bacec6a4431754555314467348ee38dab1ba7b840a88b1fd69af0a1980df51fecd9c1423fa8bfd7ce8d5b27a0aa6a0f25f283b8ea9c32482ac0a8ef2e04828