Analysis
-
max time kernel
179s -
max time network
136s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
28-07-2024 20:07
General
-
Target
211a799947f1d87b07805bca8725e5c1_JaffaCakes118.apk
-
Size
302KB
-
MD5
211a799947f1d87b07805bca8725e5c1
-
SHA1
7b17f4b082c3347dc71d5706033a0495a56ebdc6
-
SHA256
e5810404028a6fbae83e17835c090cb5f2ebc6b3c3d6f3bf363025cc152d7402
-
SHA512
bd5b62bd0529e980ebdb890fea06a38edaafafd20faf68831c4e5b1afbd957acd2edfe1dcc143f08b85ec14980b7bf049fbefd4c23a65be4e480ccbc4e28bec2
-
SSDEEP
6144:3XSlk9+M0u1mAlQX+1oNv9HDSmz9DA0nGNLb3V0epbh2tIm1f+zQN+:nWk99h1Eui1NDPYPBb2f1N+
Malware Config
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.tciz.hziz1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572KB
MD516d1819fae1ee17fe24b9d7a2968e681
SHA1aac698868aabe4994ce10ca91d615ebbda6da064
SHA25668f61cf717864679d3343bd58d6057eafd8d55fb7ccf4e39028d2c6576291e30
SHA512565f969d57c5bb005fe41a11f4c95bf8885851aea333d971731fdfab3642eedabbcbca648f72913a825377a0d87c13de1612d43aba0964ce3dbd3c05c4e5ce67
-
Filesize
828B
MD568ca2d0fd25d3e1139218588a6927c1e
SHA1238f9175f2ae0d62a9a952fabcf782ac28ee80ee
SHA25642a3b2e42011d90c45274f0c480a55d470ecb3151846135da620b38b49565aca
SHA512be30441da7a6c143a596b21704eef827204d0c51bf5c184437a583957a75b8677b3c402a56f4c483eade7e57e88b09b4c2bbcad2e028c2a2d8f4cadb7277b997