Overview

overview

10

Static

static

6

fe78d87edd...f7.apk

android-9-x86

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    22-10-2024 22:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fe78d87eddefb5a2c8ee0612bf784a8174c2b7e324ac0b8335118dd3506f12f7.apk

  • Size

    212KB

  • MD5

    cfa27fd6d1257afd30b0df6dd1b775f9

  • SHA1

    bcea37598b094ceedb018d1c0bcd3cf79fe0f38a

  • SHA256

    fe78d87eddefb5a2c8ee0612bf784a8174c2b7e324ac0b8335118dd3506f12f7

  • SHA512

    ea38b14f47dd3da64abab300e5760cc1dbf721a67b327a54fc889c922db03c792919f0a7d06091bc29b98fd26c00b702c687ceb2a13241183e37084e71119063

  • SSDEEP

    3072:LTV//AapbWfPP5d7G3ASs7Dcgh9J3hH21Bvu4MiUDxML0vpN0GoY0UXRLcnGWax:dnAaRKPniQpXc+9HW1puiU9MgPVpWax

Score
10/10
xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.226.54:28899

DES_key

Signatures

  • XLoader payload 1 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk
  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
    evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • nvinaao.coxteisaq.jjhvoc
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4290

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/nvinaao.coxteisaq.jjhvoc/app_picture/1.jpg
    Filesize

    8KB

    MD5

    b19b217cb1a942ed88d04471561b13a4

    SHA1

    5b53020c830bee9d22a9226dbd486ea7a24b9b90

    SHA256

    5985329cee335f9973ab1aedecc3134c220c4621cf0ec2976762f5534f3821b5

    SHA512

    44aa0f6869e7dfa5f31ae846aa11fcf432c68ff60b0ec15707be1251768ac5aba66b37b7e11dfcd1b9adc9b757be8679d22cb2e13ea1e5d306c8f7e3f30502a0

    Download Submit

  • /data/data/nvinaao.coxteisaq.jjhvoc/files/b
    Filesize

    446KB

    MD5

    5705e5b58e9503402cf66c15fbc1d854

    SHA1

    ac943d94e87db55183a1cf24517c3d40361a2d03

    SHA256

    c8e371d5021bc1f77ea2062c2a568ada090e464099596476536816b4feb1f5e8

    SHA512

    46ed8f6f3a670ef3dbf0477353d3da5a19f3a188b51ee8cea492e3a6ffed77d14663eb1732bc084bdd78f4fea0a4190c39399a20aa2f6b6c92fc91bded97e70d

    Download Submit

  • /data/user/0/nvinaao.coxteisaq.jjhvoc/app_picture/1.jpg
    Filesize

    8KB

    MD5

    25404c361cb4b8d82bbc3b6de9eefbcc

    SHA1

    d1cf392c877139ea460aa30678b8fc64d81523d4

    SHA256

    ff64e3ccab5c095d051a9b394d62d8e2e3ef986beef211e69879041d9cbdb3c1

    SHA512

    aba763a19e9c1895e6a48a4293d2d5ad7ae643e5f1e2180e39333d10fcd2ea9a01178ae8efa5a017ffeb42560f49da996008b46308af04126760129ee20de825

    Download Submit

  • /storage/emulated/0/.msg_device_id.txt
    Filesize

    36B

    MD5

    9a7d612414da6d499bee24f651272502

    SHA1

    6b01e1d2b00a09f8e7d09511c8a50daa6064df99

    SHA256

    52fba98ea8d989b00effe261cfd2cceb28e5389b5cd0c038d8d53f8de4490808

    SHA512

    50a1603f52410ec3d14865a14f9fb2dc125e1eb41cfb8d072b49804e9a2cc45d4d3881d93af0be83710ff66e887a47aa240843930e55b053d9b3af0845245b3b

    Download Submit