Overview

overview

10

Static

static

6

f058384313...3b.apk

android-9-x86

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    22-10-2024 22:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f05838431300d80ffd4dd7d4316cfe92086d815d4b4797276798821a128c053b.apk

  • Size

    212KB

  • MD5

    87eb2dbce1b681d3ed8d62654f2f88a2

  • SHA1

    068b2b972206f70bbc4249117e58a933a1873ce6

  • SHA256

    f05838431300d80ffd4dd7d4316cfe92086d815d4b4797276798821a128c053b

  • SHA512

    03ea5dc8e66388742a1cafa27b839b4413828d3c251f7b94c39d6dabdfcd68477bea5c5a634c2460330bf057d991e254fb1f3cbe1176d3f6393dfef39ef06144

  • SSDEEP

    3072:IvqV//AapbWfPP5d7G3ASs7Dcgh9J3hH21Bvu4MiUDxML0vpN0GoY0UXWLcnRfwH:IvsnAaRKPniQpXc+9HW1puiU9MgPVV4

Score
10/10
xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.226.54:28899

DES_key

Signatures

  • XLoader payload 1 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk
  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
    evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • fipztae.yqxhdaqdp.sdyfan
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4303

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/fipztae.yqxhdaqdp.sdyfan/app_picture/1.jpg
    Filesize

    8KB

    MD5

    4a4b195dd0ed579c867a2c07d67cacd0

    SHA1

    7ca7a737f90af1225150e553f76b42b500fe9ddb

    SHA256

    20a8c0b88e32accff6b75183f07c77fdac04effffabc883cde33bfc2ed1c9c49

    SHA512

    24d00f63af1328b7d39fab722291d49e2ad5a2e48153815829ec78eee914419055ee9a1374d3f2790979fd319f42d4ebb2d54278983c661bb29b0120ead361d7

    Download Submit

  • /data/data/fipztae.yqxhdaqdp.sdyfan/files/b
    Filesize

    446KB

    MD5

    5705e5b58e9503402cf66c15fbc1d854

    SHA1

    ac943d94e87db55183a1cf24517c3d40361a2d03

    SHA256

    c8e371d5021bc1f77ea2062c2a568ada090e464099596476536816b4feb1f5e8

    SHA512

    46ed8f6f3a670ef3dbf0477353d3da5a19f3a188b51ee8cea492e3a6ffed77d14663eb1732bc084bdd78f4fea0a4190c39399a20aa2f6b6c92fc91bded97e70d

    Download Submit

  • /data/user/0/fipztae.yqxhdaqdp.sdyfan/app_picture/1.jpg
    Filesize

    8KB

    MD5

    4136acddb16d31c3ccc86d2e15f19461

    SHA1

    63ccbf5f2c1df982c02ba630b97f9d3b31ea143e

    SHA256

    4c960a3738df4f5b499dd8351d450f84a0b0f3bb0cf035744366bb7940f32cb2

    SHA512

    3047ca04f48965983c75b85194ead5e9753698fad97713767459e9a9d3538d5a4927570254724c570b0ab73c6747c7c8482aa03702bd17730dabbebf3c5f9736

    Download Submit

  • /storage/emulated/0/.msg_device_id.txt
    Filesize

    36B

    MD5

    382807b1fbd36024475863ddc06b7a15

    SHA1

    fbcb0d7c0d64e92bf5dfe71629940af33dc05c48

    SHA256

    198304e0e8adb7ffd9da9b4a48910e61951bb508388631a915a640456ee65120

    SHA512

    9547a867014ef24ac7123a9690dbe627d81dd25d1bf7ca1779d65364a9bfda87ae90ff58fc4a57f567e27a5ac2f4d7273a01be3d5805707697fecc6683f04c56

    Download Submit