Analysis
-
max time kernel
179s -
max time network
143s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
09-08-2024 22:12
General
-
Target
328003ac6366ca93ea59be355d0341f61431c3d9fe2c90e9fdd5d7595d8c8f05.apk
-
Size
387KB
-
MD5
423d0bba81bb2db08eb952032b6d527f
-
SHA1
e47bf08fe37dd47182ae5321d512ac2c3f0cae31
-
SHA256
328003ac6366ca93ea59be355d0341f61431c3d9fe2c90e9fdd5d7595d8c8f05
-
SHA512
ace41cf2a1d27a4ff247cfeedd44da2a0b5558ea3e6b14d2083cc33a778edb75daab123e1e0dc743005c7a01f73ede0496db4b06b799cd787895a635aa3877b5
-
SSDEEP
12288:PSg6abeCeB+BahHuDf6iz93pK1c15Lp0gbCC:EQeCW+BahODftpbmC
Malware Config
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
Processes
-
ndonx.ndonx.ndonx1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
686KB
MD5b964645e76689d7e0d09234fb7854ede
SHA15c38844d5618f51ce356d95c5811760305eaadd4
SHA2561588e671c3c29ecbced61b01f08622562614cb9b19411cce3e259deafda6f2b7
SHA51240d72c1ea0e15fce48d09bfd1761d792f7063fda57566994140cbd59c8d6ab88e7dedb79b2e64ef7a5569bec6bf8b1a0bbf5d9c3484f7e5bee38275352867ec4