Analysis
-
max time kernel
179s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
26-08-2024 15:15
General
-
Target
c343198b04d56cfc3fd442a995dea8ea_JaffaCakes118.apk
-
Size
436KB
-
MD5
c343198b04d56cfc3fd442a995dea8ea
-
SHA1
6441de9bc0afa2dd32d0ab02f1be5246defb8120
-
SHA256
2929c003ddaca6fb379719a69ce6aa59029c87ba25106675f2fc81891a4e3a62
-
SHA512
b5616b007e1df8cb1d3eb7fee9b44285a8b8a54511261e05e1a1cdced149b04660ee04a5b053f5cc9b9d68baddaf5310bae0976ba00bc04652443854f5231a72
-
SSDEEP
12288:XXI4EDwOtOckYHiQAvGtXKEDH3tQg7q0woQVNOi6JvO:InDrkpYfAO8ED97u0xSO+
Malware Config
Extracted
xloader_apk
http://45.114.129.49:28866
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.yzpk.mpzw1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
ping -c 4 45.114.129.492⤵
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
766KB
MD5474a6c270ad9ce11d542743d22f4f618
SHA15465c0640e725a1745dc32aaaa455a7e88b6df30
SHA256d37c5d615adc341d03f84b43e8fd060c4b8de258420f4d9076428e37039d8510
SHA512aebeb07a5daacbb1a33eb26cc472393e9341c01d2413926ed3101543f77e6bb4b0884fa2a49ea9947bdf99f6bdea6deb162ca1cfcda25be16a21d3767be2f4fb