Analysis
-
max time kernel
149s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
22-10-2024 22:11
General
-
Target
ea5c2a2c095be4cc7589f4ea50f83944b8345480c88dda47bd5a4b7879616c21.apk
-
Size
208KB
-
MD5
6f4bdd060b6afc82b0b0e425d33a90e8
-
SHA1
5ab76e0272242a3847581b941d15499c4b0b8d58
-
SHA256
ea5c2a2c095be4cc7589f4ea50f83944b8345480c88dda47bd5a4b7879616c21
-
SHA512
98120eac9178247b474329bb80934253574b5c4b4fae52d3c78ab6b0ef4248353246b4623f7e9069896d595de6a63f0753586a04ce853b505f346dbe3a0e2869
-
SSDEEP
6144:WuD8wENuEEOndbUhnoPV8srF4HSBMlcI6yFeHwW:WuDebdb2KqsA7leyFeQW
Malware Config
Extracted
xloader_apk
http://91.204.226.105:28844
Signatures
-
XLoader payload 2 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
qg.srrn.myx1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests changing the default SMS application.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
446KB
MD58bb09c2927ef88bda95970b61599f314
SHA1391656ad53355854928f21a99e995f14e5c75ce7
SHA25627ec66655a2a5e63f95ec2a4066bf7e64a79d7070923f42ba0cbffe53e2ba2dd
SHA51294f59ce40f5b0a03c7bf0c4d199b47c4c7f85f98ae686f6994d74119f7c4b76d031d8607a879818d92c9097ce7603dbfef55d850186a21add9dee18f2bf90d68
-
Filesize
36B
MD5d95b7903ee6222df4cda7d03a903b67a
SHA1dab116355b211883c0860cc34b9bc6083f899b0a
SHA256fa431b4c63313accad1a3ed319658314eb7525a5b5cb8980b6ee076755d295d4
SHA5121262b9f00baa60b46f7e16ec3090380b9393be1d59dffd6c80553764bc417968883a2d608a5ec3c534549145cdfbab535298c81fbaf1fd95ea9796e1618e4e65