Analysis
-
max time kernel
179s -
max time network
152s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
16-08-2024 22:03
General
-
Target
8dcd768c9ed0bf3f9e3bbfc0cf097462228b027d43da9d4a791bb53896ce70a2.apk
-
Size
454KB
-
MD5
398eb03524e4595fe10a7cbf5eb6a50b
-
SHA1
cbd9dacf1363670011d158615b6003d10abaa6b7
-
SHA256
8dcd768c9ed0bf3f9e3bbfc0cf097462228b027d43da9d4a791bb53896ce70a2
-
SHA512
09de6bca7cdd56e6970e73e26c7537457451385ac388b8f719989a019272b3e8c582f654294a48e975858c1c328d9afdaf746a579ceb98eb07309fe2abec4c36
-
SSDEEP
12288:p83wA26lQus3JhHrpRR4OR9OKdFvaq8mc6SzH:6H26VErpRR4YkKzcR6SzH
Malware Config
Extracted
xloader_apk
http://45.114.129.49:28866
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.wftk.ssgy1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
768KB
MD551015c1475527cc1918c76c669bf1a76
SHA1d12785950302f1f0eb82fe0bdcdeb4d2b8c59de3
SHA2569cff8f2c6781a95262361d8e531644742ff95d2afc91fab2d74c434b907fe648
SHA5120a9d7cab85093263f3d5cbf3fde71234ad263e039b79f9ceec030042f8ca90da12eef87e29d0dbcdc4538a87a220c9807e58faaa50b39300f97f0bb46ebc6c10
-
Filesize
820B
MD56266bb81e4afab8e9067bb127257db66
SHA13fc3e4a8fb2d7a7b7d069a376093c9bdcb509edc
SHA2569b284a69451671e9b5e7bcd94c723f73ba08d23b56448a08b67bbe563ce7e3cf
SHA5128a833b302eeca04ec688d5eba8045f8581114f7c5df15f46927b899b3ba20060b4791aa2dac4aac8627cbd66798ae06562a981c0cc6443637a140038fe55e2c9