Overview

overview

10

Static

static

6

cdd98fe66b...64.apk

android-9-x86

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    05-11-2024 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cdd98fe66b7b87ba7615b85f56a795b3c47f0de0c7a95f8c947e671b40ed4564.apk

  • Size

    212KB

  • MD5

    838b20c6b6a6f202da192c1564e058ea

  • SHA1

    827d5a89293707071547dd950328bab70c3fbd33

  • SHA256

    cdd98fe66b7b87ba7615b85f56a795b3c47f0de0c7a95f8c947e671b40ed4564

  • SHA512

    f03d3b87d1189776d15e46ef7745fc13af8bd33d30af1e0c2cc3414a0ad7d1095fbec5f88981a2a28a04ba4ba7380d4d8da7a9195af70566d6f41d73b6cc0cd9

  • SSDEEP

    3072:a9I+yh+OWk1Ms3eg5KUCB9KJXuRIJvSYpETVmdDVIojpwGwsfvsIMaJgcE5o3xAm:Z+bYnKUyIuRIJvfEslpw/seapZxw2zv

Score
10/10
xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.226.54:28899

DES_key

Signatures

  • XLoader payload 1 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk
  • Xloader_apk family
    xloader_apk
  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
    evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Checks the presence of a debugger
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • tmsnhhz.xhtrubpke.ktdiyp
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4247
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/tmsnhhz.xhtrubpke.ktdiyp/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/tmsnhhz.xhtrubpke.ktdiyp/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4274

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/tmsnhhz.xhtrubpke.ktdiyp/app_picture/1.jpg
    Filesize

    7KB

    MD5

    5aed505687c14a16cd8355be8233ed24

    SHA1

    5543d1f0f49e59a3a85606ae503871b542f1c94c

    SHA256

    b58123098f38a44da69da7d99582b416d33b242ed9adc610f89de1d848076fd9

    SHA512

    9a50c9a9db34d6974d06a75f2f171a04bbc980f23d23cfc314b408405ebc0e141a601d1f62ae642268b469db383419068a399436b727d208eaf552e2511c9bac

    Download Submit

  • /data/data/tmsnhhz.xhtrubpke.ktdiyp/files/b
    Filesize

    446KB

    MD5

    a08eb40c8f41932cdfbb171b11047499

    SHA1

    640df821c78b575ddc1fb1ba3150795ae8a38af2

    SHA256

    21de04b706537eb676cda25497d25ce84e45d132232f715656f81c1e66ea4767

    SHA512

    03512be8115948dadefab3d4490e82fe8ebf5baa79765ecb63aec0b1ffa97c29ab37d68abf628e35ecb186ac1e81b2f259d392891eef2633707288803921442c

    Download Submit

  • /data/data/tmsnhhz.xhtrubpke.ktdiyp/files/oat/b.cur.prof
    Filesize

    1KB

    MD5

    d6fda1016bfee233b9c18e2d2f0f10ce

    SHA1

    7685e4cb4171c601284ca4a773177394e98daaf2

    SHA256

    0177084e32a284df96c972089929fe1465ce316edfb282ef10121459a872db8c

    SHA512

    f880eaf75ad92071c454413bcf9aa5aabaaa3e2963e3ee37ed904da2483c40462bd4349dbe4522816fa54e5007d0006c245e4f55dcaada7c86f097b1b6310e05

    Download Submit

  • /data/user/0/tmsnhhz.xhtrubpke.ktdiyp/app_picture/1.jpg
    Filesize

    7KB

    MD5

    e0d9e27fabd5dbfd1d29b0a421e44987

    SHA1

    853966d8d58eaf5931c0045abe63d2ce2307dfcb

    SHA256

    2c55e3e353e3bd84ffb06fc5f36e103489ccfbdccc0c5d8f44ffd530604949bb

    SHA512

    e74cd42b8a16605f29ddb41edd23b32aeb96deaa8ebcb0f34abc046db00c68cffd8798bf68fc75882cec0b513416dc380068b61757c47e638c39850cab1d4e3a

    Download Submit

  • /storage/emulated/0/.msg_device_id.txt
    Filesize

    36B

    MD5

    1afafd814518fa70fcbd965e0c946eb4

    SHA1

    f023e62ebc3632ab812818fb01677f844795b3cc

    SHA256

    3da22a78c8df0b33419290217c7a13f01127805e553cfefa89e87c6ac77b5f50

    SHA512

    16d83b5ef17d345b396fa85f3eebb50f56e3514ee4582574df63505f071729d742b48f8fa028c96da631ab5291ac863898c6bb50a15b862686ee23d4356e6924

    Download Submit