xloader_apk | de7cc077ef1b2f0dd1193aebab7fb196d69992aa1a810c462730d9a2b13c3d28

Analysis

max time kernel
149s
max time network
158s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
07-11-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de7cc077ef1b2f0dd1193aebab7fb196d69992aa1a810c462730d9a2b13c3d28.apk
Size

212KB
MD5

68193ad9f34622ba3a5a26f47afb05f3
SHA1

3a000fec0108a73923404712bccc069f78c4a552
SHA256

de7cc077ef1b2f0dd1193aebab7fb196d69992aa1a810c462730d9a2b13c3d28
SHA512

d62a6f7bfd494445771016200600e194a5d736f84b6d89c006b18390c4ae3ad413537f38cd9e9c65353e3c207b96b5071713a6039d5ca0c39780516693fba5d2
SSDEEP

6144:9pURp25utootdfoWIuRIJvfEslpw/seaph2O:rzNoHgJuRYflysN

Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

Malware Config

Extracted

Family

xloader_apk

http://91.204.226.54:28899

DES_key

Signatures

XLoader payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-5.dat	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Xloader_apk family
xloader_apk

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	nlsyrfx.wfcammbvd.yaudqi
/system/xbin/su	nlsyrfx.wfcammbvd.yaudqi
/sbin/su	nlsyrfx.wfcammbvd.yaudqi

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4253	nlsyrfx.wfcammbvd.yaudqi

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/nlsyrfx.wfcammbvd.yaudqi/app_picture/1.jpg	4253	nlsyrfx.wfcammbvd.yaudqi
/data/user/0/nlsyrfx.wfcammbvd.yaudqi/app_picture/1.jpg	4280	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/nlsyrfx.wfcammbvd.yaudqi/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/nlsyrfx.wfcammbvd.yaudqi/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/nlsyrfx.wfcammbvd.yaudqi/app_picture/1.jpg	4253	nlsyrfx.wfcammbvd.yaudqi
/data/user/0/nlsyrfx.wfcammbvd.yaudqi/files/b	4253	nlsyrfx.wfcammbvd.yaudqi
/data/user/0/nlsyrfx.wfcammbvd.yaudqi/files/b	4253	nlsyrfx.wfcammbvd.yaudqi

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	nlsyrfx.wfcammbvd.yaudqi

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of the MMS message. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://mms/	nlsyrfx.wfcammbvd.yaudqi

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	nlsyrfx.wfcammbvd.yaudqi

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	nlsyrfx.wfcammbvd.yaudqi

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	nlsyrfx.wfcammbvd.yaudqi

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	nlsyrfx.wfcammbvd.yaudqi

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	nlsyrfx.wfcammbvd.yaudqi

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	nlsyrfx.wfcammbvd.yaudqi

nlsyrfx.wfcammbvd.yaudqi
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4253
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/nlsyrfx.wfcammbvd.yaudqi/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/nlsyrfx.wfcammbvd.yaudqi/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4280

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/nlsyrfx.wfcammbvd.yaudqi/app_picture/1.jpg

Filesize
7KB

MD5
61a5408b65c35c454be002f2ca3b49f2

SHA1
5a12e949a968406ad33918195326cdfd76594316

SHA256
911dda9b048043093465a208de438ce1fec8b4d3f5cc961aaae160f6658e502e

SHA512
d87bb51c0793fb9d94e54114492317314d206b43298ea21ac12e4774b7a2cc0fcf3ccfdd07d0072faf1544bd0a572763acf0bd81fed963e13433ffe98cfa076e

Download Submit
/data/data/nlsyrfx.wfcammbvd.yaudqi/files/b

Filesize
446KB

MD5
a08eb40c8f41932cdfbb171b11047499

SHA1
640df821c78b575ddc1fb1ba3150795ae8a38af2

SHA256
21de04b706537eb676cda25497d25ce84e45d132232f715656f81c1e66ea4767

SHA512
03512be8115948dadefab3d4490e82fe8ebf5baa79765ecb63aec0b1ffa97c29ab37d68abf628e35ecb186ac1e81b2f259d392891eef2633707288803921442c

Download Submit
/data/data/nlsyrfx.wfcammbvd.yaudqi/files/oat/b.cur.prof

Filesize
1KB

MD5
d307e5b56ed24809b9f620b122d13d5d

SHA1
a4ad92059ed6884ed43e3d0d8712eaf94b3cb9b6

SHA256
df217487b1f4ccf2b471fe738b47ba67d1ed320e53d0f9a7f64f60b7ee4034f9

SHA512
0553c3a0921643d2ae1d6e67e3791b58f8af609908a65a31a14cc85079662934dac7dbf5a462206f9913daa51845d13af586630b5ca41cbfe54c181bab2589d7

Download Submit
/data/data/nlsyrfx.wfcammbvd.yaudqi/files/oat/b.cur.prof

Filesize
1KB

MD5
271b79d6add6b248cd0418704f1acdb7

SHA1
4d0ceda840a7aba169c537b35e14b95734da82b2

SHA256
ccc2880c3fcab280558a625a25b0cfc0967153bb1073f1ba0aadfbfac1027cd7

SHA512
3d21efe79d69e26ddd10d32be567f2573696148f7cc6598b3db455a65e0d8c98eede078afdfc3a28cd3a5a34d2614a7abab1695a2be7d2807e5171eb02acc47e

Download Submit
/data/data/nlsyrfx.wfcammbvd.yaudqi/files/oat/b.cur.prof

Filesize
968B

MD5
aa0b78caa9339463ef23c0150ebea69a

SHA1
f92d9ce02875bb72f6f77ee70c7a7ed5a3af547e

SHA256
9a9d026c27d931af1cff69a940603229e5bf4af03bd494d37976ffabd4b7b7e5

SHA512
460b881067cb188ddd474a8074264735a02f1005aef03b248636ad6d099b3002e627ca2a965e49aa6bc7f87d9ec2308603f76be1e777874ee3db7422155c3d87

Download Submit
/data/user/0/nlsyrfx.wfcammbvd.yaudqi/app_picture/1.jpg

Filesize
7KB

MD5
0c8ba39485182fdd7773b10a9be80f69

SHA1
591ca5393997f9b7d76c5b73794006631b349b6b

SHA256
33b99cbee406ac883b77712ed9184263a42a5fa7b64bffa5c8a2aa703d1206d6

SHA512
3827a6b35385e6017fd7e012a0256ca2b2d68361f2c9f76a89b4d30434d537978b60bbf4f6daf07fd1d50fd11b3241a5cdee655cdb7269367d5fe3255bbada07

Download Submit
/storage/emulated/0/.msg_device_id.txt

Filesize
36B

MD5
3a5c00ac1b7df85417df1990954d6a7c

SHA1
e223140b876c4e8021a2d0bfc3f773891767b5c5

SHA256
2390e9d98c024164789310c7b4743823d92c76e06f9ddfe1bfe3fa340a3b73d9

SHA512
3c12fafe0d4379594561dd0d9ed913aaf66f2002a30ff9041debfc861d45d2d70821e9d42a8010aa993b2c1cf3a54128e327265c3447059cef3f1cdc5faaa06e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads