Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
18-10-2024 22:02
General
-
Target
5bff4036089fe1ce942fa2f5b53890bd960e96fa8c68275539672c834231dec6.apk
-
Size
278KB
-
MD5
66463cdd3bd695a55f1fda1e16b9431d
-
SHA1
94e7daf03334a0d08b9dffa92f2c06c3ab06e716
-
SHA256
5bff4036089fe1ce942fa2f5b53890bd960e96fa8c68275539672c834231dec6
-
SHA512
c5ba1769c27ddfa7862c7e65f1fcc3fc5053ad4a12d7600fec84bde272e8cdf23d79c62192a8ff84633ce5c57da81311fdb0bd01087a4f54981f2a15acef61e6
-
SSDEEP
6144:OSd9gIXihVbD3L6BwQZBJ37tDhSC+q6FrfMbXS:OJIXihVbD3+BwkBFt/366zS
Malware Config
Extracted
xloader_apk
http://91.204.226.105:28844
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
jwrb.zxdfok.ozkmdn.ttswfh1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
493KB
MD51de744484e7d7385baca06eb02986485
SHA197398c5e27f988e55327daca9f3b391552acf9e5
SHA256a86d40402acf532ce17f2e6f1c3349fb0fe3e6061507b95be164c242081c6abb
SHA5121e00977c3aab9a2e8c26844d7e6a16bb4e37589a83e49b5e9d1224cca794db586d7a307ae08021e5e979b45d56daacac9b6f285491d5e996fc10e0702784b8c1
-
Filesize
36B
MD562bd10f639f652dda2a01e954c97114d
SHA19ff1a2257943003429d626e630ac6d6ab8e9b665
SHA25620cdcb2e1e1c0f7bf04079ace6cec10359403f2f0bbe896df9757599df21fb9c
SHA512fd7d7d5b98c793df180cfc44d19b4e52059f92400587f1dff837405ebdb52890a530a32ef6da9324fc069c72f01ce9121bdda51fd8d0ba867e456d73ced9ec76