xloader_apk | b0fc509c9a3107b9df85b554107a1ae6b787687401aa8b4e01ca3ffe395adbae

General

Target

b0fc509c9a3107b9df85b554107a1ae6b787687401aa8b4e01ca3ffe395adbae.apk
Size

207KB
MD5

40f0d7ddf98c880d93ee41139b3a6b5a
SHA1

58e98d1b12d58c327d2aa25c9c8d03a7c1b55b3b
SHA256

b0fc509c9a3107b9df85b554107a1ae6b787687401aa8b4e01ca3ffe395adbae
SHA512

f96a6aacddbd14a8119cbbfe42c54f44039cd8ce82a7eb77fde5582e7273a834e3e7fa092e71d7d69299caa2c3ab2fb43182294aaedecf9d2107c5eaf9e45d4b
SSDEEP

6144:aQiPd1yj5HrFM4y1QXnXf/G/DaxS96vrucoAl:at1EHoiXGraxS9o66

Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.226.105:28844

DES_key

Signatures

XLoader payload 2 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xloader_apk
behavioral2/files/fstream-1.dat	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Xloader_apk family
xloader_apk

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	ozur.tduux.mppmu
/system/xbin/su	ozur.tduux.mppmu
/sbin/su	ozur.tduux.mppmu

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5049	ozur.tduux.mppmu

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/ozur.tduux.mppmu/files/dex	5049	ozur.tduux.mppmu
/data/user/0/ozur.tduux.mppmu/files/dex	5049	ozur.tduux.mppmu

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	ozur.tduux.mppmu

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of the MMS message. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://mms/	ozur.tduux.mppmu

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ozur.tduux.mppmu

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ozur.tduux.mppmu

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ozur.tduux.mppmu

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ozur.tduux.mppmu

ozur.tduux.mppmu
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5049

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Protected User Data

1

T1636

SMS Messages

1

T1636.004

Stored Application Data

1

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/ozur.tduux.mppmu/files/dex

Filesize
456KB

MD5
6e3d29b5306a57dba7028a8da4609797

SHA1
da143c2306182d664c850b74b4afa7fa948c974d

SHA256
07f170fb70397d72a187bcdb83adc11f2e7c6d5a928d951d4f24b5e82dc04d96

SHA512
e9dadbc1fa4244e681a22178a512bf8ef0b5a41e6b80e54f09ef8f5fd120ac25c55db8a6ff53f748ba0ba22eeee84eb8714bc79468da921d4ec8f0129bd60915

Download Submit
/storage/emulated/0/.msg_device_id.txt

Filesize
36B

MD5
139934e4eae902cca619b0b08137aeaf

SHA1
2ceefcb4a2dd032e1f3b286461fdfbb684e0b2c0

SHA256
f9d7f2a0077e8bcd00c190b536217a81581b808ed30a700fb973011a562fc4bb

SHA512
e78f73807efb7a6c3dd2f835cac335db33de69cb382fd36dc2ee1ccd197840cdea65ab058611c37070b87e1108ceeb2550392ec5167672cd5ea8ffc6cfa77521

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads