Analysis
-
max time kernel
179s -
max time network
160s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
29-08-2024 22:02
General
-
Target
4cdb181400a6f4ad95026f2c25edb7746595b464b8e7002dfe50427efe989eff.apk
-
Size
302KB
-
MD5
45e901a653b772464c3475d34d7fe701
-
SHA1
80b7e3fc407586ce77907ceffc502ffa5d93c13e
-
SHA256
4cdb181400a6f4ad95026f2c25edb7746595b464b8e7002dfe50427efe989eff
-
SHA512
f95e76b90e1819e8937e92a8f45487d284d2b12ab0c62c4312c93e88c647bee4af68687ad9bf5adf4d6b3194c8214188f4284e7d7d5bf6198602eb3d0164c19a
-
SSDEEP
6144:3l8T3fTneHlJn1l9Kwvhk15g7rV4pEtgb3lznRNSe6tm:4PTeHlJn4OI+Rjtgb1znRXZ
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.iflp.vymr1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572KB
MD5e3c8db2847f2325c2ba52de79c90b0e4
SHA14f32e7e367b22247e1cbcfd347bc231029269420
SHA256a5fb4d92a41ee44a387d621543a1b9ffa9bc04d6201fee0458cfe21638a62173
SHA512d1764d880a6d2bf0bd44f695df586a140b7d8a240a5f76cf715bf53337135cf956af68b754563b48f8d25175044dc819fa7d988c5a68fde95b19ac8ad181a0ca
-
Filesize
1KB
MD5b95aa8e65fd808175fcc7ec5b9f3bab2
SHA15a5e738627674eda83cccf0aa1bf9edd7807234b
SHA25674392487d0ffbfffb2efe69b66db0b568866c9d9ddec4cfd24103c6fdc2923eb
SHA512c1a84e94f93f0532c32a2b9e42f30d58815dc3f3a547f535bb799596d4e135c37b927d5d99d664f6b06f6387c1dda289da409fa0480d0d87f4871b8ff9e5c305