Malware Analysis Report

2024-10-19 11:53

Sample ID 240908-196qmsyanq
Target 4f54f67515b0e697bc7502f62af674e72cc5464b01c2b30189bc6ef6a7d0c058.bin
SHA256 4f54f67515b0e697bc7502f62af674e72cc5464b01c2b30189bc6ef6a7d0c058
Tags
xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4f54f67515b0e697bc7502f62af674e72cc5464b01c2b30189bc6ef6a7d0c058

Threat Level: Known bad

The file 4f54f67515b0e697bc7502f62af674e72cc5464b01c2b30189bc6ef6a7d0c058.bin was found to be: Known bad.

Malicious Activity Summary

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

XLoader, MoqHao

XLoader payload

Checks if the Android device is rooted.

Removes its main activity from the application launcher

Queries the phone number (MSISDN for GSM devices)

Reads the content of the MMS message.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Loads dropped Dex/Jar

Requests changing the default SMS application.

Requests dangerous framework permissions

Acquires the wake lock

Makes use of the framework's foreground persistence service

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-08 22:21

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-08 22:21

Reported

2024-09-10 09:57

Platform

android-x86-arm-20240910-en

Max time kernel

149s

Max time network

151s

Command Line

frcb.nhmjo.vqhxv

Signatures

XLoader payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/bin/su N/A N/A
N/A /system/xbin/su N/A N/A
N/A /sbin/su N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/frcb.nhmjo.vqhxv/files/dex N/A N/A
N/A /data/user/0/frcb.nhmjo.vqhxv/files/dex N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection
Description Indicator Process Target
URI accessed for read content://mms/ N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests changing the default SMS application.

collection impact
Description Indicator Process Target
Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

frcb.nhmjo.vqhxv

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 docs.google.com udp
GB 216.58.212.206:443 docs.google.com tcp
GB 216.58.212.206:443 docs.google.com tcp
KR 91.204.227.39:28844 tcp
GB 216.58.212.238:443 tcp
GB 216.58.212.238:443 tcp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
GB 172.217.16.228:80 tcp
GB 172.217.16.228:443 tcp
GB 142.250.200.35:80 tcp
GB 216.58.212.234:443 tcp

Files

/data/data/frcb.nhmjo.vqhxv/files/dex

MD5 c5654523e4899cf11630fe902e74b494
SHA1 d51781ac831b0442d5aaa8fb801d664f0daeb1c4
SHA256 fd7e515d5732df7cc5632a8411671fdad79815c7df963ef68f728398c8c8db31
SHA512 19e1fdb04673dec606e0376b0ffb4e32bd12d37cf50d22815c114ccc2a76824b114835ef858e0fbc84d89dc6be1e1951be047e24521771c05d6ce43fac137bdb

/data/data/frcb.nhmjo.vqhxv/files/oat/dex.cur.prof

MD5 ea4a148dff5bd271dd1ee2df33c7a00e
SHA1 5db9668877d0379242cd10eefca846ef48bfe2e4
SHA256 839bcb67ee8f7e9c4ac4dc237bc332ccb48f61a04b68b7f9fb75672031c74bd0
SHA512 f828916dcdfdf08b0de1cd90ec05706ee0f6c97856d85b1ad52ea24b874360a5dc94ad8f3849ca9df0300612b31a75e1d3cf3504f6ae4775dc03e4c1f085e229

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-08 22:21

Reported

2024-09-10 09:18

Platform

android-x64-20240910-en

Max time kernel

149s

Max time network

152s

Command Line

frcb.nhmjo.vqhxv

Signatures

XLoader payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/xbin/su N/A N/A
N/A /sbin/su N/A N/A
N/A /system/bin/su N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/frcb.nhmjo.vqhxv/files/dex N/A N/A
N/A /data/user/0/frcb.nhmjo.vqhxv/files/dex N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection
Description Indicator Process Target
URI accessed for read content://mms/ N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

frcb.nhmjo.vqhxv

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.212.206:443 tcp
GB 216.58.212.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 docs.google.com udp
GB 142.250.200.14:443 docs.google.com tcp
GB 142.250.200.14:443 docs.google.com tcp
KR 91.204.227.39:28844 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.204.72:443 ssl.google-analytics.com tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
GB 142.250.187.194:443 tcp

Files

/data/data/frcb.nhmjo.vqhxv/files/dex

MD5 c5654523e4899cf11630fe902e74b494
SHA1 d51781ac831b0442d5aaa8fb801d664f0daeb1c4
SHA256 fd7e515d5732df7cc5632a8411671fdad79815c7df963ef68f728398c8c8db31
SHA512 19e1fdb04673dec606e0376b0ffb4e32bd12d37cf50d22815c114ccc2a76824b114835ef858e0fbc84d89dc6be1e1951be047e24521771c05d6ce43fac137bdb

/data/data/frcb.nhmjo.vqhxv/files/oat/dex.cur.prof

MD5 05ca1299587e7d7b6b8299e62fa31b70
SHA1 347f5993c44c5abe6bfb2010e4e027c910d2fee1
SHA256 ad63e6dc2b88b66299a445237fff1d82300c484e5d4da419f723ff0ceab8706e
SHA512 0f81179543aa3cc2445919287d159404a979e061ed5691ade63aa57bc34da0950901452d2bb84fbc690d60659599e14356060478c1c770837cb1d404ae65d9b6

Analysis: behavioral3

Detonation Overview

Submitted

2024-09-08 22:21

Reported

2024-09-10 08:52

Platform

android-x64-arm64-20240910-en

Max time kernel

149s

Max time network

154s

Command Line

frcb.nhmjo.vqhxv

Signatures

XLoader payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/bin/su N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/frcb.nhmjo.vqhxv/files/dex N/A N/A
N/A /data/user/0/frcb.nhmjo.vqhxv/files/dex N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection
Description Indicator Process Target
URI accessed for read content://mms/ N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Requests changing the default SMS application.

collection impact
Description Indicator Process Target
Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

frcb.nhmjo.vqhxv

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 www.youtube.com udp
GB 172.217.169.46:443 www.youtube.com udp
GB 172.217.169.46:443 www.youtube.com tcp
US 1.1.1.1:53 docs.google.com udp
GB 216.58.201.110:443 docs.google.com tcp
GB 216.58.201.110:443 docs.google.com tcp
KR 91.204.227.39:28844 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.72:443 ssl.google-analytics.com tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
KR 91.204.227.39:28844 tcp
US 216.239.32.223:443 tcp
GB 172.217.16.238:443 www.youtube.com tcp
GB 142.250.187.225:443 tcp
US 216.239.32.223:443 tcp
GB 142.250.178.1:443 tcp
US 216.239.32.223:443 tcp

Files

/data/user/0/frcb.nhmjo.vqhxv/files/dex

MD5 c5654523e4899cf11630fe902e74b494
SHA1 d51781ac831b0442d5aaa8fb801d664f0daeb1c4
SHA256 fd7e515d5732df7cc5632a8411671fdad79815c7df963ef68f728398c8c8db31
SHA512 19e1fdb04673dec606e0376b0ffb4e32bd12d37cf50d22815c114ccc2a76824b114835ef858e0fbc84d89dc6be1e1951be047e24521771c05d6ce43fac137bdb