Analysis
-
max time kernel
179s -
max time network
173s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
12-08-2024 22:07
General
-
Target
d5b0b858e2c4a8e895565803d33359adabfd35e5a9aea7c6ce7bbf5d40ce76c6.apk
-
Size
441KB
-
MD5
3fcbc3e4388418d2392b6d50d0ad1580
-
SHA1
4a776a1a29e6dbce77028a628ce3eb663f08f055
-
SHA256
d5b0b858e2c4a8e895565803d33359adabfd35e5a9aea7c6ce7bbf5d40ce76c6
-
SHA512
27189175496b7f7fe5a59f5e6d9a182301c31d1a8088688a3f52d13c42b7157eec000639014c9238302207d347ee3a201112007304368a1fc47b48821dff3d7e
-
SSDEEP
12288:5HTBZhceHB0kXlQyu3Clc6EOO5ucU3T1X//QoS:lhxhR1Q8lc6ELEFl/Q
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.jyow.nfxv1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
ping -c 4 91.204.227.392⤵
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
768KB
MD5f8726cbd90914c9659ffaf685c95119c
SHA1980221db5798d17d477dd072425869d7cf5cf92b
SHA256e93656da8141475737bda15f8d69126fd20b83b14d2ff5ea5f4ff13958be50cc
SHA5120272bfeca1710e2d28bd9d08c9693fa7afb8c7b77d323f2b0cbdbf1a64bf679e26fb168d4153333df13d05b48351a31ca76f4639d70e53022a166c9aece6db38