Analysis
-
max time kernel
149s -
max time network
134s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
22-10-2024 22:09
General
-
Target
b181e386fe054ff6346ed0821f382a8201c150d9ca6bc612dfc5335cfe8a2f42.apk
-
Size
434KB
-
MD5
073a0b8f8c43e35ed0dd6ce0bd5277a9
-
SHA1
fb7b0df4329efe94f103467bc1faf4ad959e84ad
-
SHA256
b181e386fe054ff6346ed0821f382a8201c150d9ca6bc612dfc5335cfe8a2f42
-
SHA512
ad64057f5fb42ffcfec2764a2a8444a00306d45b2f8e8d65a1b8d8cb73875e57f2bf27fb44453306136a700fa76d240cc1579e710c4dc78a8bfad2cc75199bde
-
SSDEEP
12288:L/KPDwUEhMBUE8DtuK/fi+JWAxrv4zfhWuODAm/e:+pEaBUVr/fiRQk0ACe
Malware Config
Extracted
xloader_apk
http://91.204.226.105:28844
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.bdwd.dddv1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
766KB
MD5f4d3e97741d6170ffdf0fe6434b3bd51
SHA1fd8718ad2332b417c7b432f0b0eaac8cb7a009dd
SHA25642ef6ee6b4c2c26333b3572c8ba6db03a74a23ed6e455a29c65f3249c8adfb3e
SHA5122f98eb992a9c75e6d2f1bfe467db40d4f02fb0f29be99ce21c17b41fcf5a4a3c73e21d63a6c6d5987c7faa72cc26ac69b0206fd988511c37150c54f0b5b39598
-
Filesize
1KB
MD50b9a97906add421afffd950d3e713bc1
SHA16dda18b6c8b8fd50ac907c08e27aad4b8aae1e42
SHA25669df535c5941c670e3a7d1b1ab637c176ae973be5fbbb870d5528c2e34aacacb
SHA512514d85af39ac4533d98d4310603e8a1aa43b59efdb3ca8390d4f9f1429adcbd469ff4439e91942057088d10da945140840021a93deefaffe9b1d8ce44d5dff22