Analysis
-
max time kernel
179s -
max time network
170s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
10-08-2024 23:03
General
-
Target
c06f63a22545c6f9c68a04d0fa3d6a8681f351f270329625b5a6612ea9c630dd.apk
-
Size
288KB
-
MD5
7527a63e70faad69a0b851637d91f5fc
-
SHA1
0c1671f5884e77d62bddc2e05029565e82b2bc3a
-
SHA256
c06f63a22545c6f9c68a04d0fa3d6a8681f351f270329625b5a6612ea9c630dd
-
SHA512
61bc055e9f917048d75c476aa66bc31a8027bab7026c6163a672b5ae13b619f2b2d9410cf909d7d43b295292c65375c55557a1869c3adab1c64fbb09d22ea6fc
-
SSDEEP
6144:2n+nbpBdcGmh4i96RYrEe5g6IpIgvA01JYPkl6e24wyq3KPHm6ux:1XdcZh4dRFe5grkkyf3KPm/
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.cogw.wqev1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
MD5ccb0ba6ba7ba68690c70d59924a595c6
SHA1d8ef45c75fa9e280d957d24c8cf754021708d0f4
SHA256aa2777f1ecc605371ab6b5ad6834e180029524985672ac8f3d4f68aca15a379d
SHA51240a2dde59493b7770f6dc9dae2eef3ea890a5b07b40f07b6f17f7f1db5153a0fe468daaf728b801b5392380d0a62f0168552a5ad54efb8d42c93dda350142618
-
Filesize
812B
MD5b4fa392b54decaa8ac3032b1c2f0e75a
SHA1d33a651deb61df1300876b29ae3d029a2d42a1de
SHA256610968e2bc5357cba71c79834b6bf50b576558c00766c38db72ec4383816874c
SHA5123991948a2a9e02595d5da522b2cf6ee44efea050ad4ddce56d16f486e6bed6e72cafcdc8297a0d6bdf4ad5318b60456213f022902e4e222e79232497b9d67bf6