Overview

overview

10

Static

static

6

bfe3313ed1...db.apk

android-9-x86

10

Analysis

  • max time kernel
    179s
  • max time network
    184s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    29-06-2024 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bfe3313ed143b888a3bf3a0b89fe4251a6666cb8ded0b10ffa0676b2fdb653db.apk

  • Size

    408KB

  • MD5

    c23162a739b3c4b24eccc8d532701e04

  • SHA1

    043b1dcbd504545fa5cb5c371ef8705918f5270f

  • SHA256

    bfe3313ed143b888a3bf3a0b89fe4251a6666cb8ded0b10ffa0676b2fdb653db

  • SHA512

    11156e269511e4dc767d4ef6018a3f060d092942c7a564700ce70aacf99d8ec1235469f1138d2979aa623d9d045c384f77ff14e3b0181955c1148c3b6bed6d5a

  • SSDEEP

    6144:iyQDz3a12UH/aiNBkcnOxH2R30vUEbObpm8jYJAwuCo1W+6a1ASqDnJLRcOqoXjy:KDNUHiiQDhu0vUEbqmEYxSW5aSSAbcqe

Score
10/10
xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.50:28899

DES_key

Signatures

  • XLoader payload 1 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk
  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
    evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • rlvgcsb.iegfgpeev.otbwrj
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4289

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/rlvgcsb.iegfgpeev.otbwrj/app_picture/1.jpg
    Filesize

    166KB

    MD5

    610c34925efa2c2efe8976c84a78f8c5

    SHA1

    d1eb0f6bb6a1a6ae984cabd660a62d5a093eb8eb

    SHA256

    4e0fe9ab99a6b4fc22de020d33bf91e15e2492b8a4f131e27f6d9043e3a24824

    SHA512

    60f9a66ba55805f97d0e0279bcac48c1a4eb6842604e3a5c30e3574cf0bc7bce0592e6d3a7fb60f1487ace5b9fd236b0eecd7d7d16ec8809a7aa18604e6d675c

    Download Submit

  • /data/data/rlvgcsb.iegfgpeev.otbwrj/files/b
    Filesize

    446KB

    MD5

    5daa1f3756c6785b25d466ca6b7bdc50

    SHA1

    ad6a6880ad1b812434e5bd3b2c1717ba11b54cf6

    SHA256

    a1695cf685fbf9712a67bbc7f9bf82c6d6fe5f8ef185f1ede33fcb76526143c7

    SHA512

    2dbeab1cfd8658b6681d3bda791f2fd3f1199c9aee135b1baa1e91abf87d20de221eec1027f611356781b7c6dbb823b8b157509ced30b03a62f6842fbde0e7e9

    Download Submit

  • /data/user/0/rlvgcsb.iegfgpeev.otbwrj/app_picture/1.jpg
    Filesize

    166KB

    MD5

    7882f9d2607a1bac95571433613ecb2a

    SHA1

    575e73150b29acc1153498fd23fdadf79593f0d2

    SHA256

    392ecab147ba034bc16e9dfbdefc2037b5928fab73d2ffea65bb859c10a33911

    SHA512

    c087f4ab0742274cd88330c2808eae8a0405b12c867154e337f0c8ff7c141a0d6ce38eef37eba37db88b0b05bb9ceab9bbf36010fa041165d4a7eaea6aa9f51e

    Download Submit

  • /storage/emulated/0/.msg_device_id.txt
    Filesize

    36B

    MD5

    fbe5a95ecec97660bcdf8844f5659d88

    SHA1

    8480673efb4834d0612199d139fa63bc84929432

    SHA256

    dd17a708854c604ee6fd99c63ace4efc6b801782a7ff87cedbc9d398fe050093

    SHA512

    da8c145f07e83a889594a6993094fa1f7623b79bfef1f518e8991af709cb5838efbbb7c95b4ca739bbc396853e1ed1041bca53a4cb067ab0b056c2126fcb6d63

    Download Submit