Analysis
-
max time kernel
179s -
max time network
172s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
09-08-2024 22:14
General
-
Target
5018a3c684150c2fe51abeff223301e3b3572de3674498fbe2b38cd72c64728d.apk
-
Size
296KB
-
MD5
402f5bdb95f051721b288b3e14f68957
-
SHA1
585c028e3061bb276e36a0be1cea3c6f4d8204f9
-
SHA256
5018a3c684150c2fe51abeff223301e3b3572de3674498fbe2b38cd72c64728d
-
SHA512
22a0f676939dfb1d0df5c36310828ce2e67864804eb9d9c6aaf3cf7e8088f6ec562ea2e54778d3cd79b15269f486b41f5b93f6b120ab59963f475dce43ce4fb9
-
SSDEEP
6144:/REKhj14kdXtyFEaQJ1og63BIjglQjdtBLUdp6uV4P4ukcFffqu7fi92wIry:55F13d9rrmg63Csq31ins48FfSGq9h
Malware Config
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
Processes
-
com.cvna.gewa1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
482KB
MD5d356a5d4f99da960b4f1f7b1b180c88e
SHA11ee02ba1e3d93f16646b8d528069f33b3732979a
SHA256e27e72dc9c66efa8f19128e5ad17dd211f6e06c90e17c20e6fa676433dc2764c
SHA5125f6de8a15ba4a94df19650a1ce70c0f5369384d2f4c57afc0290966a8ade712f286b2b2358a8ae2699edbb65440beaca1def7bd1f7da9a5e63e8bd34d33b6978
-
Filesize
798B
MD594e2232ad40a3493a7e14b0c3ff81f2d
SHA16cfc6c1bb802cc8156f212698bb019c4519ece05
SHA2563c27dcb5cda6dfcad3e175aca24b643da2d07a3daaa67d7400fb47692226a06e
SHA5125ef6559743ef2e552c38a9bb342a5fc75ee822d91922bc39a81d429d9b93744836dfa9361ad7d598dcb76d2400cbd5acc88cbff543551b459c25f1b69f2d9725