Analysis
-
max time kernel
149s -
max time network
154s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27-09-2024 22:01
General
-
Target
fafab384768cb4b1b9c1f13de6720faf_JaffaCakes118.apk
-
Size
427KB
-
MD5
fafab384768cb4b1b9c1f13de6720faf
-
SHA1
b61b575b3764aa4b260bb46dfb2c653d72b94415
-
SHA256
b67262d26e6fbe7dca7543245edf7f748507c4cacf1dbc6ef3d16d39c63dc0cd
-
SHA512
e657d455ee9de135a46d87af0007e2ec6b629418eb8ffadeb2efb6d6b5fb7dbfa51a6a2ce5011b7ddadafd7e44d04781d8b86a25e451bfec11c9d7442a8e4bf9
-
SSDEEP
12288:OpH3tUmxd3dgVlnPlE2nMz5CiPUjUHJJZ7on:03tUmTd+9nnSAiPUjUHrZs
Malware Config
Extracted
xloader_apk
http://103.249.28.208:38876
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.cusx.ujrz1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
ping -c 4 103.249.28.2082⤵
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
764KB
MD59ef682a5daa6666a6e69a38c37a635b5
SHA1602bba780bf668e0b8d3870fe8ca28e128d1f78c
SHA2561ad70cde19de653276cf7af790d4ad5117f88a5ada3c2bd2d981a0b6206c2dcc
SHA51284e90344c9afea40a540100ba944d6d3d979cd7279e4ec9082638a4a28ae1cb14e8b1de84f18742a0c46ae4f9bb0944c13ebba9e9e8751dfd58f34995c9ff2b2
-
Filesize
1004B
MD5e3fc3e5d9bc1fe7a4205f1f06279a551
SHA1234e10a1ab5a46a054616d9499636a5f13762271
SHA256f7504a5054f6b24272360a28436fb1cce5f12fde8f486d96ed64fe5980e0a40e
SHA512e93078e1c556ce5c137b27bf1ae8253d4f3b2daa6257c42c973a88d2132eb87df9322e49de5584d9620ed828fbfdade8c21aa8b434c93bdb4a55ffa9e87c421b
-
Filesize
1KB
MD5177a2f0f01727664b8a2535b4d2aa64f
SHA1a638988a238c378c51bd32edb3178b6959b0e019
SHA2569b9979bf08264ff702e3333b39e8b2d11e8945cf0a05cc3d96423a812f423ed0
SHA5120ee09bc3056aefcfa0837ad766d7fc1086b77c0d6181e050fcae77b097dba534db84b5aedbdce911501d4c9dd720540ff1baaa9ee90976eadd90b6b969e1a0f9