Analysis
-
max time kernel
179s -
max time network
179s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
10-08-2024 23:03
General
-
Target
c06f63a22545c6f9c68a04d0fa3d6a8681f351f270329625b5a6612ea9c630dd.apk
-
Size
288KB
-
MD5
7527a63e70faad69a0b851637d91f5fc
-
SHA1
0c1671f5884e77d62bddc2e05029565e82b2bc3a
-
SHA256
c06f63a22545c6f9c68a04d0fa3d6a8681f351f270329625b5a6612ea9c630dd
-
SHA512
61bc055e9f917048d75c476aa66bc31a8027bab7026c6163a672b5ae13b619f2b2d9410cf909d7d43b295292c65375c55557a1869c3adab1c64fbb09d22ea6fc
-
SSDEEP
6144:2n+nbpBdcGmh4i96RYrEe5g6IpIgvA01JYPkl6e24wyq3KPHm6ux:1XdcZh4dRFe5grkkyf3KPm/
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.cogw.wqev1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
MD5ccb0ba6ba7ba68690c70d59924a595c6
SHA1d8ef45c75fa9e280d957d24c8cf754021708d0f4
SHA256aa2777f1ecc605371ab6b5ad6834e180029524985672ac8f3d4f68aca15a379d
SHA51240a2dde59493b7770f6dc9dae2eef3ea890a5b07b40f07b6f17f7f1db5153a0fe468daaf728b801b5392380d0a62f0168552a5ad54efb8d42c93dda350142618
-
Filesize
900B
MD5bf7979f53dbff40d44be5d10853f746e
SHA194eed74a5bfbc0ec37f7c5af9bd4facc2a59b102
SHA256205c3e7449f43bb9441ff203287be1a389fac2d83d95a5dd015685801a7c6cac
SHA512efeb151063ad36ffec418a0fa5732b736fd740a944817d8b445eaa980014bb2fbb5443f802319193665543d1c82196d2a40e77c70bea2290edaf29212dc10940