Analysis
-
max time kernel
149s -
max time network
154s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
03-11-2024 22:02
General
-
Target
571d7d5f64c79a4203663834f1b4dc1767b9112efdd730cf803da484dd773a8b.apk
-
Size
212KB
-
MD5
86babedb33c85c913514d05867714816
-
SHA1
7526089bb057dc662061cc52a840911c21ec95b2
-
SHA256
571d7d5f64c79a4203663834f1b4dc1767b9112efdd730cf803da484dd773a8b
-
SHA512
f27935b9b6e5d8417b27eec282f15f2ddcf4812b85a43fec49204c82ac9aadbc23964f527fadb8ee4c90617fcd90766fb9c3cb12d0d0d6393d58aef9feb76061
-
SSDEEP
6144:N4qbJaooUEcIkG2TsA+4kieQyOg2sPbx+:N4YUUEkG2TsA+45S2sPbU
Malware Config
Extracted
xloader_apk
http://91.204.226.54:28899
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
mcugpbi.wpvqaowbh.vvnrdv1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/mcugpbi.wpvqaowbh.vvnrdv/app_picture/1.jpg --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/mcugpbi.wpvqaowbh.vvnrdv/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD53f6304e46b5096dea9f1604ef2f4a5db
SHA1601ec357e27cbff3e778747c89f8dd833a293a02
SHA256ce1b19ffe066f0c606869b356aa80ad82a2e06742f4bd207b28950ebda194beb
SHA5128931e9a6f258a144b02947a6987f89ed5ec7cc38e59aa9e4e221c6a9aecaf61fc11f31cfeff7550fdcd1b0b52713a1ac98afc833fe7453b22c81f625c9e058b3
-
Filesize
446KB
MD55705e5b58e9503402cf66c15fbc1d854
SHA1ac943d94e87db55183a1cf24517c3d40361a2d03
SHA256c8e371d5021bc1f77ea2062c2a568ada090e464099596476536816b4feb1f5e8
SHA51246ed8f6f3a670ef3dbf0477353d3da5a19f3a188b51ee8cea492e3a6ffed77d14663eb1732bc084bdd78f4fea0a4190c39399a20aa2f6b6c92fc91bded97e70d
-
Filesize
1KB
MD586ed61ac06d7bfeb6a83048ca7224c5d
SHA1334cfc38c0f9b6482a1d1241e59a6f8616249f35
SHA2569f4fcea7e6bff2d37a614318332fd6ec308e4cf9647227da99b7afb59360878f
SHA512b3f2e18e0a377b7bb4dd076d8f774722a36ad047773b6ec833a7af6cce4513e90e6e4cdec65d286ae7fbd9091ab0ceccbb168a5f6f6c28ebdbd5371079ac3344
-
Filesize
1KB
MD587f65337c38c9e49080304cc0f02cd32
SHA12234a5d3bc4f4fe0eb8961bf52588100c62da242
SHA2564a5e813e7a5bfe4f31bd522e2e9a841889a8e4500c835f4708034f08818317d9
SHA5126e54e04b3987fc86c5f342c7494a75c1b1f19e692a68c016c0da48cd86e13637e8054be81c1f6849702d19d58bd828aedb2b31c423ea3d2aa049c14bcc39e055
-
Filesize
1KB
MD5b37a22298904b604479c29cfdd713302
SHA1237af930c8d8306dfec7f435ab75a814015f5bbe
SHA256e3065c3eb408bf836258d872345cb21712b08da8a0cc72089df3baa51b513cf9
SHA512d9fc94376a67380fe77832dd6c4de03585d0e8b6e0ad0894dbd299243b0a987ab63fb45a4ac56e90f4c4a5775416d73bb1006cbf3ce80c586a2cb3c36d627391
-
Filesize
8KB
MD5884f558ef79a7c15d00da287c87229be
SHA157aeebba74874c70ecf593c49880f8a5e092e2f7
SHA256222fcfcb7b355a6cac919df4b4ad727f4eef6f973a596647f8add93996d49c50
SHA5125b77a4a839139254615ba512798b33b64660da1893679be9866a245ec19ac0f9be0fa0948f05f5683996cdd0a56d9bd5a148a51e17c8cf49627ea510e5c9e5be
-
Filesize
36B
MD5a6c963124bf4ad66c9bebc747ba250c0
SHA13c7d6b39fd4783497d9212b899713d4d1df828a1
SHA2562af81242156a03902cc716864e36bc417420f8f9a5fa928e062dafe51abb781c
SHA512baa841b4ab764c737f722c16d72c3b19d81e5f51ab9f96d5fc105553306041dd0aa6070a58c74ccc4acea4ca5a73625187c9107ca5869e526802ed8a0010344b
