Analysis
-
max time kernel
149s -
max time network
136s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
27-10-2024 22:02
General
-
Target
b0fc509c9a3107b9df85b554107a1ae6b787687401aa8b4e01ca3ffe395adbae.apk
-
Size
207KB
-
MD5
40f0d7ddf98c880d93ee41139b3a6b5a
-
SHA1
58e98d1b12d58c327d2aa25c9c8d03a7c1b55b3b
-
SHA256
b0fc509c9a3107b9df85b554107a1ae6b787687401aa8b4e01ca3ffe395adbae
-
SHA512
f96a6aacddbd14a8119cbbfe42c54f44039cd8ce82a7eb77fde5582e7273a834e3e7fa092e71d7d69299caa2c3ab2fb43182294aaedecf9d2107c5eaf9e45d4b
-
SSDEEP
6144:aQiPd1yj5HrFM4y1QXnXf/G/DaxS96vrucoAl:at1EHoiXGraxS9o66
Malware Config
Extracted
xloader_apk
http://91.204.226.105:28844
Signatures
-
XLoader payload 2 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
ozur.tduux.mppmu1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests changing the default SMS application.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD56e3d29b5306a57dba7028a8da4609797
SHA1da143c2306182d664c850b74b4afa7fa948c974d
SHA25607f170fb70397d72a187bcdb83adc11f2e7c6d5a928d951d4f24b5e82dc04d96
SHA512e9dadbc1fa4244e681a22178a512bf8ef0b5a41e6b80e54f09ef8f5fd120ac25c55db8a6ff53f748ba0ba22eeee84eb8714bc79468da921d4ec8f0129bd60915
-
Filesize
1KB
MD5f805434c3834ea2e77801e8d43c3e324
SHA1b75a03f5f06250924c1bd38936f55a43a4bbfe25
SHA256b5188250bd9d4b38df1e077da76c694a8dbbd8b35740b6c47b5eb7e8ceb50d42
SHA5123402137fc9f98862e62ca0c49595de16d978cdb285a4a1b3929e57619f65367f2f92333416b8f7e6c87e916957055647f963b2d5cb5c6c5efd3f65c9b34d7387
-
Filesize
36B
MD5ef4e2dae053af8724e2afadd265177eb
SHA1300c0cff140bcab3e5d9131ebc0a2c83c2fd9a5c
SHA256b5172a1b9c9495ecf7cd3cc0a27635f7011b6431e7fd6613689e7dcc1ef8e632
SHA512e00ed3fbfa73f56ab0ffb7395cdeb7b1f5dded3fa233e60dea09c9c8008420e5f1933ce3943dd1bc8e30fba3dbc08cda3336f773c2e01b9285bcfb6171294534