General

  • Target

    c2dc31eb4daaa4d3b5b5846968f8e96cbd7a42394cfb9abb6ff32ab4b51d05f7.bin

  • Size

    205KB

  • Sample

    240809-156vvawckb

  • MD5

    fae8aaa0691837760f92935068d00401

  • SHA1

    0b35df462fcd6ca9d21b21c103f50e0347738664

  • SHA256

    c2dc31eb4daaa4d3b5b5846968f8e96cbd7a42394cfb9abb6ff32ab4b51d05f7

  • SHA512

    17681a846b04f44fa77ec5eb76a85de348c4af8183b0d3cb017737625960a60ef7bfcbbc6dd68903b20df17d83309ff280a3bed0ced7b87b378325546449e5cd

  • SSDEEP

    6144:C9eqHYEfoB3e/fIjmcRcUJ9uZHDafE8d0OD7V:C9eOfIeYaudJ9uJDas8d37V

Malware Config

Targets

    • Target

      c2dc31eb4daaa4d3b5b5846968f8e96cbd7a42394cfb9abb6ff32ab4b51d05f7.bin

    • Size

      205KB

    • MD5

      fae8aaa0691837760f92935068d00401

    • SHA1

      0b35df462fcd6ca9d21b21c103f50e0347738664

    • SHA256

      c2dc31eb4daaa4d3b5b5846968f8e96cbd7a42394cfb9abb6ff32ab4b51d05f7

    • SHA512

      17681a846b04f44fa77ec5eb76a85de348c4af8183b0d3cb017737625960a60ef7bfcbbc6dd68903b20df17d83309ff280a3bed0ced7b87b378325546449e5cd

    • SSDEEP

      6144:C9eqHYEfoB3e/fIjmcRcUJ9uZHDafE8d0OD7V:C9eOfIeYaudJ9uJDas8d37V

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Checks if the Android device is rooted.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests changing the default SMS application.

MITRE ATT&CK Mobile v15

Tasks