Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
09-10-2024 22:09
General
-
Target
ef73e953b840f1e2f792bfe61a83ac4789482585ac07e75c61e1845dee5af5a1.apk
-
Size
208KB
-
MD5
5212c5d18e5d2ad8cd16daf82ae79898
-
SHA1
1fc4c98cd9fe873c0b3659e9e02b823b5931e510
-
SHA256
ef73e953b840f1e2f792bfe61a83ac4789482585ac07e75c61e1845dee5af5a1
-
SHA512
5a91329625f76c64fd87be44d8f56ae382735827daa7ac75a123aafe3ba65015b4b435ca81318cf9c6ad4483350f6329274b7d0104134800c08a11a2c3762679
-
SSDEEP
6144:IuTWitDfcoLORdvVSKz/h9B+STKFlwp8IzJp5:DTWitDkoyvFz/rBfK7wpnL5
Malware Config
Extracted
xloader_apk
http://91.204.226.105:28844
Signatures
-
XLoader payload 2 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
j.vskj.ar1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests changing the default SMS application.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
446KB
MD58bb09c2927ef88bda95970b61599f314
SHA1391656ad53355854928f21a99e995f14e5c75ce7
SHA25627ec66655a2a5e63f95ec2a4066bf7e64a79d7070923f42ba0cbffe53e2ba2dd
SHA51294f59ce40f5b0a03c7bf0c4d199b47c4c7f85f98ae686f6994d74119f7c4b76d031d8607a879818d92c9097ce7603dbfef55d850186a21add9dee18f2bf90d68
-
Filesize
36B
MD579e81be156bfd15aabe71739b3b670c0
SHA16a39bd13074ce6667eefe7a8306e8ae380b806be
SHA256e0b5bc0f1030eeb906455b6eb9bd698a9699831a60d95b50029359f835297371
SHA512ed83ac57fca281315db4ea89c1563523fad129a311bfc33c26cb7d11cfa2a5d7f69b2ac481a05b466813212cf3f2f9d976db445818b287e7ce9266ff5c3a9ed8