Analysis
-
max time kernel
179s -
max time network
139s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
09-08-2024 22:14
General
-
Target
5018a3c684150c2fe51abeff223301e3b3572de3674498fbe2b38cd72c64728d.apk
-
Size
296KB
-
MD5
402f5bdb95f051721b288b3e14f68957
-
SHA1
585c028e3061bb276e36a0be1cea3c6f4d8204f9
-
SHA256
5018a3c684150c2fe51abeff223301e3b3572de3674498fbe2b38cd72c64728d
-
SHA512
22a0f676939dfb1d0df5c36310828ce2e67864804eb9d9c6aaf3cf7e8088f6ec562ea2e54778d3cd79b15269f486b41f5b93f6b120ab59963f475dce43ce4fb9
-
SSDEEP
6144:/REKhj14kdXtyFEaQJ1og63BIjglQjdtBLUdp6uV4P4ukcFffqu7fi92wIry:55F13d9rrmg63Csq31ins48FfSGq9h
Malware Config
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.cvna.gewa1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
482KB
MD5d356a5d4f99da960b4f1f7b1b180c88e
SHA11ee02ba1e3d93f16646b8d528069f33b3732979a
SHA256e27e72dc9c66efa8f19128e5ad17dd211f6e06c90e17c20e6fa676433dc2764c
SHA5125f6de8a15ba4a94df19650a1ce70c0f5369384d2f4c57afc0290966a8ade712f286b2b2358a8ae2699edbb65440beaca1def7bd1f7da9a5e63e8bd34d33b6978
-
Filesize
808B
MD58d4406ea044ff8ef3da25145a9005eed
SHA13cfdae1ec82eebdbeea918c912e0e8f73327cc1f
SHA25601fbeb8fbeed40bb18cbfe8a0d98ecf14af7a4b4298afe101dc9f17d0981139f
SHA512c1abf975ae77235dc0450e06429277ac79c74d0bdc0eb03e51e922c7487aad3edf9ddd29207c5a89527700173a81dacec32e31a3ff21e59192a2d3b7e6786658