Analysis
-
max time kernel
149s -
max time network
134s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
05-11-2024 22:04
General
-
Target
d0d4f9b38e622f14a5ee772d387d36d1515f834d32764c6d94d738e611fd8b36.apk
-
Size
209KB
-
MD5
2e90682c3a9479ac37e5f3d57bf5359a
-
SHA1
190712bac218156bbf77fc6b01f76b671cf1fa41
-
SHA256
d0d4f9b38e622f14a5ee772d387d36d1515f834d32764c6d94d738e611fd8b36
-
SHA512
6b90239889f372a9915a33f6ebb669d3bfde86e0e175639f013133d771b442367597a2cf318e2aa52844cc89385f81df9cd4d61817f1fd6e8c2ca62fb8b7a9ad
-
SSDEEP
3072:PdicbQ3GbY5ocbP42vqdlmQkAINykIUDPfgVIHvkrq/ln0Sq2erb/sCNQd0fzldi:P78GQEojAINykIkXgVuvkOVxq2eH/Qwi
Malware Config
Extracted
xloader_apk
http://91.204.226.105:28844
Signatures
-
XLoader payload 2 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
l.rngytw.nq1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests changing the default SMS application.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
453KB
MD562dded91437cc7c895dc49eab14c80f5
SHA15ba00620dabdb8b8c63d459a951d4850e8d585b5
SHA256f86036172c22e92c8754a06846b5221ef5e957651c100c48205a85e650b3ad81
SHA5128ae828640b439091186e5f929fda51abefd468c3fbd72e02ab2afdfdf0c9c9ebd367b807826b760ea159250a7ef5b1673c92c4db2e696ace6d019b3004d64f5a
-
Filesize
36B
MD5b6e1590b598928ae7224dc6e86c43aef
SHA17ab2cf45e7e6f8de455fe9dba321c6c4d206e0e0
SHA25644bbeeb5bd9ffa0a48292b55aa072b7bc7ebcbdddf8c4766268c07ed836ce9a7
SHA5125f9c54da77c5c856d3330adc9cfb2f0c7a424881041f779ba756b5ecc7c90531a738b14baf0b93b5581aa8320e9b4648e1101737279e92cf253415e181d92ddc