Analysis
-
max time kernel
149s -
max time network
137s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
04-11-2024 22:03
General
-
Target
776840b5a98e36ae3157731d6111c5de2d511b81b68be6db3d287cec3845eb37.apk
-
Size
217KB
-
MD5
53a56f3f2686a0190a35fdb304b4ad8a
-
SHA1
2cc0ab0d59a24102e725430598d69d0f5394186b
-
SHA256
776840b5a98e36ae3157731d6111c5de2d511b81b68be6db3d287cec3845eb37
-
SHA512
c092a0c28a4c491b4eb44bd3f87a8df83acb0521183cf882f5dff4fd9eafe1a3b919692e8a93917c42ba1fa6bbc2f26faf33914b3a0fae83abf148ff2bd96a9e
-
SSDEEP
6144:AW76JSFUv40g+MFAHxHO+izNzPq6uYarPzR70FT:AWWY0g+ZHxYzNb9uYarPcT
Malware Config
Extracted
xloader_apk
http://91.204.226.105:28844
Signatures
-
XLoader payload 2 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
aget.zowzh.lfouw1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests changing the default SMS application.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD56e3d29b5306a57dba7028a8da4609797
SHA1da143c2306182d664c850b74b4afa7fa948c974d
SHA25607f170fb70397d72a187bcdb83adc11f2e7c6d5a928d951d4f24b5e82dc04d96
SHA512e9dadbc1fa4244e681a22178a512bf8ef0b5a41e6b80e54f09ef8f5fd120ac25c55db8a6ff53f748ba0ba22eeee84eb8714bc79468da921d4ec8f0129bd60915
-
Filesize
1KB
MD563dc86cbb60aef6c89ca81ec932841a8
SHA151de56e65f2b7bf008fc53ab9e73a952ffd63257
SHA256e2b830a42436ae53c99015a951568e84bf60de3a5e3f42a148d1cbd3b247529b
SHA5123c4983d4a2824ea0222beb4dd1cbc2f4ca4749b0920a523ea08fa0b926347e233c3775a8d14e419c0a4312742abe3c179c712438647988e50d6449b89323330d
-
Filesize
36B
MD5c13fd5220ce8f80d15a7da0780c03b56
SHA11d90a7599640828ddc8d2efbcccf7081feb1d029
SHA256bd55a927c139265fe119de8d3cc9017cb8f889b6d0c6cbab2be07149f31e7a20
SHA5127b18f6e20eb558bf7d1787106af54de5ab29a330e470213393c8d36245a518284aa240485b4cebcff8ee28ca07a0d6752cefea7ab9dc55b7adfe513d00c6e0b2