Analysis
-
max time kernel
149s -
max time network
155s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
27-09-2024 22:05
General
-
Target
be3c37b1f21014a616ef496db8e6e836c49d1363675695c803ca8cecf9069719.apk
-
Size
303KB
-
MD5
eb3f7e5389471d6576a0e83dc8d9c586
-
SHA1
9c318dd0c7b975aa234a7db6e8601132f5316bcd
-
SHA256
be3c37b1f21014a616ef496db8e6e836c49d1363675695c803ca8cecf9069719
-
SHA512
9a7193185733941c831d9333c1a35c2a27514cf5fb15b45cb92e86677e0ed0943cdec80275200a33bbfaa32167d6139ae67a687a76ccc3b928105ff6564db9a0
-
SSDEEP
6144:DzEkGt/AJKXqVrVz3vPJPVXdJxUE2pbZ7fHnsiqHt72t:pJkchbPJJxF2v7/JqHu
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.eqqx.qmki1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572KB
MD5e3c8db2847f2325c2ba52de79c90b0e4
SHA14f32e7e367b22247e1cbcfd347bc231029269420
SHA256a5fb4d92a41ee44a387d621543a1b9ffa9bc04d6201fee0458cfe21638a62173
SHA512d1764d880a6d2bf0bd44f695df586a140b7d8a240a5f76cf715bf53337135cf956af68b754563b48f8d25175044dc819fa7d988c5a68fde95b19ac8ad181a0ca
-
Filesize
1KB
MD570ccedd2b321610457490aac9a51c1cf
SHA19b607a914e02bd506b0d3180f2362f7eedbc7e3c
SHA256ae482c4747f729ceb0cadf416d1cb069d86cc26d183d869e11da8bff815386f6
SHA5129b511892b2207f61e6e3f4b7e189bafbe2940ccfc07abd58c4811bc7cf7ec13c6c57f46f934b36138a0e1f634c9a26b48a426b4b8aac1a0f09a1c9ff713e1b5a