Analysis
-
max time kernel
149s -
max time network
128s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
27-09-2024 13:58
General
-
Target
fa87e920fe001725d695986ee420113f_JaffaCakes118.apk
-
Size
436KB
-
MD5
fa87e920fe001725d695986ee420113f
-
SHA1
9ba494c22cf4953715425a5419c2b11eb89a22c2
-
SHA256
123f315220500032f702e31d7071a964526402c820f918262f1fb52d097ee5db
-
SHA512
5e96371e437e6b3737ac1953f5562f45a77a36dc92726d6cc39b9afb844cdc7b91aa5f2c8bda21d600c87f8b772636cb4af7d2e257385d12c87547fe0f7a7590
-
SSDEEP
6144:p6bjDqOkgFokQ8l227Sxk+hdkQCffuUR5mo9LVQ6ILW0u+ZKN85mHQmyP:gX+V8/Q7HCuMxW68Hu+Z6KP
Malware Config
Extracted
xloader_apk
http://103.126.160.21:38866
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.bihd.kwcg1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
ping -c 4 103.126.160.212⤵
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
766KB
MD5775c7f2c45475a912f6b199320e3cbd1
SHA1778578802bd028e201fc3a55c01de93f26ee2dde
SHA2565d197df4be551f05909cd286ee3f63de9fb503c22444e69091eb9c848f735424
SHA512116066d5c1da63a097e7f66f7a1f1549a0035d27c7878e98cabf9aa064bb2b72b3b91d9f3b04c68b963a1968f13d8cf2f898704262c564a89e7e2ac40135976d