Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    12-09-2024 22:08

General

  • Target

    45456d7015a687fe0688dba1059c43f6ee41f619a4da9e3acb60f43f3316984d.apk

  • Size

    205KB

  • MD5

    00ab1241b4d93b4d8862f07a4428fe3a

  • SHA1

    ede93b985eedde766348f74da2bd45322ff15ab6

  • SHA256

    45456d7015a687fe0688dba1059c43f6ee41f619a4da9e3acb60f43f3316984d

  • SHA512

    ae2cf4131742c4c2ebc76b05321e2f737816f78306602150139abd82910b959f2857488bf19b6b8348f24ce7bbca07970414c05e384dd26984185ff063807632

  • SSDEEP

    6144:ZIiBxmau9ZFYLZEK6v5SEloLsj4Y0UEyk:6+xi9SOvB0dyk

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Signatures

Processes

  • nd.yghux.olh
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests changing the default SMS application.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4248

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/nd.yghux.olh/files/dex

    Filesize

    454KB

    MD5

    c908b637c002940ef72c0f34eda33115

    SHA1

    c886b4786f696ca4be26516a83e842863e71f728

    SHA256

    125b57669edb6060fea0e71718ea17c957186496c2c1ea010d95c64218fe31ae

    SHA512

    57eafa70138d9b97af7c3160306133f1591f015563f4ebe21cb4a0354a6c2a380e246de64ea54d492e84d433b77b50d887ebdd3566002799abdeba66742ec350

  • /data/data/nd.yghux.olh/files/oat/dex.cur.prof

    Filesize

    1KB

    MD5

    c79f7b9dda05f3a482af065acf726d00

    SHA1

    92ec95aa2a4036e930fa6caba21ea8c22142ac0e

    SHA256

    93e9b1989c053e6f3e9a039632b812ac0da41c9c649c16dcd21387e95c4087fb

    SHA512

    8e8c737f3fc1856acdb7970575788f904d0a6566c34145ea69b4558c9922daecc26833f79eb7e7efe752ecceaddebd494f809c97cd7a7434d34df623d7747aa6