Malware Analysis Report

2024-09-09 13:11

Sample ID 240710-114vpavera
Target 51a5b5e359f2da80bd51d3c2122a1c274f72d6f91fd11e4c40e43092ba1f4881.bin
SHA256 51a5b5e359f2da80bd51d3c2122a1c274f72d6f91fd11e4c40e43092ba1f4881
Tags
xloader_apk banker collection discovery evasion impact infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

51a5b5e359f2da80bd51d3c2122a1c274f72d6f91fd11e4c40e43092ba1f4881

Threat Level: Known bad

The file 51a5b5e359f2da80bd51d3c2122a1c274f72d6f91fd11e4c40e43092ba1f4881.bin was found to be: Known bad.

Malicious Activity Summary

xloader_apk banker collection discovery evasion impact infostealer persistence trojan

XLoader payload

XLoader, MoqHao

Checks if the Android device is rooted.

Queries the phone number (MSISDN for GSM devices)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Reads the content of the MMS message.

Loads dropped Dex/Jar

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests dangerous framework permissions

Acquires the wake lock

Makes use of the framework's foreground persistence service

Requests changing the default SMS application.

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-07-10 22:07

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-10 22:07

Reported

2024-07-10 22:29

Platform

android-x86-arm-20240624-en

Max time kernel

179s

Max time network

182s

Command Line

com.vdeb.tjdz

Signatures

XLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/xbin/su N/A N/A
N/A /sbin/su N/A N/A
N/A /system/bin/su N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.vdeb.tjdz/files/dex N/A N/A
N/A /data/user/0/com.vdeb.tjdz/files/dex N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection
Description Indicator Process Target
URI accessed for read content://mms/ N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests changing the default SMS application.

collection impact
Description Indicator Process Target
Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.vdeb.tjdz

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 docs.google.com udp
GB 142.250.200.14:443 docs.google.com tcp
GB 142.250.200.14:443 docs.google.com tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.213.14:443 android.apis.google.com tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp

Files

/data/data/com.vdeb.tjdz/files/dex

MD5 1f8e738d4543767332a7d9f9f963b779
SHA1 7c7f9149b41bb2d7af38fb596a79b453b2786115
SHA256 ebc10f9d55656de2b07cf3600c3db028b860b725748d29bc2ba71ba8d7b5f00a
SHA512 287341becae8f4b7d25da6f854edf55a1ff6cc6a92d8e5f7569d89e791e042db97cf60bec626e9c6b3ab6cd9a7e2eef7958ab795accdc710b625eabb2ab5891b

/data/data/com.vdeb.tjdz/files/oat/dex.cur.prof

MD5 c078b26fd1c6f7f6dab2355e01231b54
SHA1 40d63e7b3c1a7fea392a6b717f9ea667cae3d058
SHA256 7db033b7eef7d2c137348aa8c40c9bb681af8e4957a2b5b5650d6bfcaf3a9888
SHA512 f18be1ac7c2c611ad253f79ff73b66d86dd055bc5b7bb08da3abcf92e4715af7c4bd662f64a24e38ab5ed27bad4ea575dfee186823e23615cacbbc463076c333

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-10 22:07

Reported

2024-07-10 22:29

Platform

android-x64-20240624-en

Max time kernel

179s

Max time network

149s

Command Line

com.vdeb.tjdz

Signatures

XLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /sbin/su N/A N/A
N/A /system/bin/su N/A N/A
N/A /system/xbin/su N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.vdeb.tjdz/files/dex N/A N/A
N/A /data/user/0/com.vdeb.tjdz/files/dex N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection
Description Indicator Process Target
URI accessed for read content://mms/ N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.vdeb.tjdz

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 docs.google.com udp
GB 216.58.204.78:443 docs.google.com tcp
GB 216.58.204.78:443 docs.google.com tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp

Files

/data/data/com.vdeb.tjdz/files/dex

MD5 1f8e738d4543767332a7d9f9f963b779
SHA1 7c7f9149b41bb2d7af38fb596a79b453b2786115
SHA256 ebc10f9d55656de2b07cf3600c3db028b860b725748d29bc2ba71ba8d7b5f00a
SHA512 287341becae8f4b7d25da6f854edf55a1ff6cc6a92d8e5f7569d89e791e042db97cf60bec626e9c6b3ab6cd9a7e2eef7958ab795accdc710b625eabb2ab5891b

/data/data/com.vdeb.tjdz/files/oat/dex.cur.prof

MD5 60971a952c11ecd7463fb2eb4a18f115
SHA1 7d14b724c9edcc2965c6f4f341a45ffaa8be63c4
SHA256 ad6f3f9b6496a4443869335f137e78b01e10b053bd76441788e6b9ae322026b1
SHA512 819212d29bf481e06c57ebf6db5f50792fa852e028e446c34b37a256ccd4fdd1636bf065bd42c5ab623b1bc81e045a5e8b9b20c690294abe181d29f787b15900

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-10 22:07

Reported

2024-07-10 22:29

Platform

android-x64-arm64-20240624-en

Max time kernel

179s

Max time network

145s

Command Line

com.vdeb.tjdz

Signatures

XLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/bin/su N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.vdeb.tjdz/files/dex N/A N/A
N/A /data/user/0/com.vdeb.tjdz/files/dex N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection
Description Indicator Process Target
URI accessed for read content://mms/ N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests changing the default SMS application.

collection impact
Description Indicator Process Target
Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.vdeb.tjdz

Network

Country Destination Domain Proto
GB 142.250.187.238:443 tcp
GB 142.250.187.238:443 tcp
GB 142.250.187.238:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 docs.google.com udp
GB 142.250.178.14:443 docs.google.com tcp
GB 142.250.178.14:443 docs.google.com tcp
KR 91.204.227.39:28844 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.8:443 ssl.google-analytics.com tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp

Files

/data/user/0/com.vdeb.tjdz/files/dex

MD5 1f8e738d4543767332a7d9f9f963b779
SHA1 7c7f9149b41bb2d7af38fb596a79b453b2786115
SHA256 ebc10f9d55656de2b07cf3600c3db028b860b725748d29bc2ba71ba8d7b5f00a
SHA512 287341becae8f4b7d25da6f854edf55a1ff6cc6a92d8e5f7569d89e791e042db97cf60bec626e9c6b3ab6cd9a7e2eef7958ab795accdc710b625eabb2ab5891b