Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
15-10-2024 22:08
General
-
Target
3813e4ca478074609654fac38211cf6baaa24bbb355e0d19acdb2270602e2d97.apk
-
Size
302KB
-
MD5
012a279310f1924c4552a2a3afc80dfe
-
SHA1
cbc21a308e564623046c5f8fb3e07ecdd84c3d94
-
SHA256
3813e4ca478074609654fac38211cf6baaa24bbb355e0d19acdb2270602e2d97
-
SHA512
caf47199e5a9342461e95a59ed14a6e3400c6eb5c01d4299b10c1ec8363b12415e397fc4dd92201296302d09085158048db0c98110dda8f1a4be5463577a3d02
-
SSDEEP
6144:PCp7EybYVdzsiH3d7B+tRyW4DxjJDHNJwj6QPX3z2p9ToCBTzk:w7EybqdzsiBBS50ZRtJwjJP3Ixc
Malware Config
Extracted
xloader_apk
http://91.204.226.105:28844
Signatures
-
XLoader payload 2 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
fctv.hxaej.snqkz1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests changing the default SMS application.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
580KB
MD58c7542abcfd5e2c08e99555d8d0bc605
SHA15f40007a5343603be18a1ce3c39ce43604099be5
SHA2560cd2b17aa21cd8de63842da21e3464df7bb2bd4a278fffbbfea6b294c3ca9e6d
SHA512362c7dd23aa52a9c72e9d90eebb99e1d4e4cd01b68348249bbeee4bb407728aabd30874488926635bacb2e1d640ad4e95852e345afa8ad66057c80c8f768ed88
-
Filesize
1KB
MD51e5e2ea3b3b213c82c883d9811f25525
SHA1b3285855b76f63ae6bca6630d41d967ca49f31f2
SHA25638b64b779739b2c578723710e1cb01a7cbed94a140d04ed4a0172d80d98f1100
SHA51238850ed959cbc6c43a27664d697b82551e52791ba9998ef4b8153eec6cbda837b31bee6c94693997945d08864694455b20a5bcaced91192ffbcd46e021208368
-
Filesize
36B
MD5b97f2eef196ce2bbc4547d1236229d47
SHA151a3b3d7a959c67f3c983ece90a80a94b69312c7
SHA256061e8ed774f23e0ea70fc3728c6136a509d40f806cc669071a4b3ed90f8e90d6
SHA512467d6d58555aafbfca4dfa6b4cbf1e7951a497c47752a13564bffe472b9bea7c6c169300ba05b575b45cb504fa8f184c600c893cb65eb770ff3eb0718e784348