Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
23/10/2024, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
8599efc0c17b3f98a4bd0c540e44792fb2714721c3716caada90da2dac079531.apk
Resource
android-x86-arm-20240910-en
General
-
Target
8599efc0c17b3f98a4bd0c540e44792fb2714721c3716caada90da2dac079531.apk
-
Size
212KB
-
MD5
d4c0ec4ecc2d60acfcc165f040085db6
-
SHA1
05382dd119d344e7abf5a13cccd0c7231ca9c935
-
SHA256
8599efc0c17b3f98a4bd0c540e44792fb2714721c3716caada90da2dac079531
-
SHA512
07ade932c37e4c5104f590470ce381e96ee3dee706c2d0896bec85526bbce41b7bf846f2929e2626b8a64f32f48f9a63e7a9d6d4cf00d89d958be49e2835f297
-
SSDEEP
6144:L2S9ZVnAaRKPniQpXc+9HW1puiU9MgPVBZ:l9AaRKPlpM2gDsBZ
Malware Config
Extracted
xloader_apk
http://91.204.226.54:28899
Signatures
-
XLoader payload 1 IoCs
resource yara_rule behavioral1/files/fstream-3.dat family_xloader_apk2 -
XLoader, MoqHao
An Android banker and info stealer.
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
ioc Process /system/bin/su hauueol.oqoywcmon.cwbpcu /system/xbin/su hauueol.oqoywcmon.cwbpcu /sbin/su hauueol.oqoywcmon.cwbpcu -
pid Process 4306 hauueol.oqoywcmon.cwbpcu -
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/hauueol.oqoywcmon.cwbpcu/app_picture/1.jpg 4306 hauueol.oqoywcmon.cwbpcu /data/user/0/hauueol.oqoywcmon.cwbpcu/app_picture/1.jpg 4306 hauueol.oqoywcmon.cwbpcu /data/user/0/hauueol.oqoywcmon.cwbpcu/files/b 4306 hauueol.oqoywcmon.cwbpcu /data/user/0/hauueol.oqoywcmon.cwbpcu/files/b 4306 hauueol.oqoywcmon.cwbpcu -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccounts hauueol.oqoywcmon.cwbpcu -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://mms/ hauueol.oqoywcmon.cwbpcu -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock hauueol.oqoywcmon.cwbpcu -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground hauueol.oqoywcmon.cwbpcu -
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS hauueol.oqoywcmon.cwbpcu -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver hauueol.oqoywcmon.cwbpcu -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal hauueol.oqoywcmon.cwbpcu -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo hauueol.oqoywcmon.cwbpcu
Processes
-
hauueol.oqoywcmon.cwbpcu1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4306
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5c13321953e54805a91d62d5434f4bb20
SHA173c4bc0fcf548344d7db207f62cc109042128d5a
SHA25605b1092f6693bdb3a312456eb57b5a400696a61ff3e622f323c596d6ce7e0890
SHA512ffa77af2db20eca5b0682147bc4bc8ab3981d2893be92b066766babb42b848db23542c6df884e3185a306f12dc0eb450ed54667a818d8c5bf4d35f5c8ec966c6
-
Filesize
446KB
MD55705e5b58e9503402cf66c15fbc1d854
SHA1ac943d94e87db55183a1cf24517c3d40361a2d03
SHA256c8e371d5021bc1f77ea2062c2a568ada090e464099596476536816b4feb1f5e8
SHA51246ed8f6f3a670ef3dbf0477353d3da5a19f3a188b51ee8cea492e3a6ffed77d14663eb1732bc084bdd78f4fea0a4190c39399a20aa2f6b6c92fc91bded97e70d
-
Filesize
8KB
MD53e921f17dbde32134bb99563316ab3d8
SHA1e8740e13d69a9ee2bbcbb6239831a378cf82c796
SHA25642115557998fe1bcc7b252cb8b2c3e72dc1f196d57f7822fc0a4393a3ea22aa1
SHA512ec3f528b6900d7c7e191d2d666d39e6e3fbc2c6ab4562f42a9e081a82706b895e3f9c1c4082d2b1816ca1826555c417781763b553c329b218eaa8779f5200894
-
Filesize
36B
MD580bd4df550c5fed06347978d9b6480b0
SHA1ea00bab424b35d55135b8046a23ec48475ecc389
SHA2561eff5af0734ca3bc19234b6740693f00b7b1fecf764c061a2a35bf291681241e
SHA512ceac144ba8a08b34bf8cc6fc0d4c16a3401b9bce37ec1067791ee23752748a6bbed8d9ba7bec121cd5763d364a18866a31c6933566f3f3bf7d2f89955518cfe0