Overview

overview

10

Static

static

6

d31541cfb9...4d.apk

android-9-x86

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    08-11-2024 22:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d31541cfb9b86ca22d3bec4d00c78d4e78936c5d93d55b9fa1da600674a2194d.apk

  • Size

    212KB

  • MD5

    086babff9df8dad4471f697b5bbbeee1

  • SHA1

    6d989ed5998b0bb4e4a7161db63385a2c1c1b304

  • SHA256

    d31541cfb9b86ca22d3bec4d00c78d4e78936c5d93d55b9fa1da600674a2194d

  • SHA512

    9cec9545963471dbbf14f68a41c052bcf710f3293e11a19f6814227403a5dc604ff0dbd34fb3739c18f938b2456fc5936df378d7dbc8c92107f81f805eae1073

  • SSDEEP

    6144:vTtbaax5utootPtUWRIJvREs/pw/6eQpnw2dv:7t3NoEWRYRls6Z

Score
10/10
xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.226.54:28899

DES_key

Signatures

  • XLoader payload 1 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk
  • Xloader_apk family
    xloader_apk
  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
    evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • ksevwua.slyhzcirx.dumbmg.qrnpbxep.ldeqj.yqcam
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4251
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ksevwua.slyhzcirx.dumbmg.qrnpbxep.ldeqj.yqcam/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/ksevwua.slyhzcirx.dumbmg.qrnpbxep.ldeqj.yqcam/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4278

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/ksevwua.slyhzcirx.dumbmg.qrnpbxep.ldeqj.yqcam/app_picture/1.jpg
    Filesize

    7KB

    MD5

    dd19a33a6eaf4df0a0a4311e0be8680b

    SHA1

    e3ee9fdffe3811248dfdb94190f06a7586507f05

    SHA256

    a3f5aea30ab1d8a00863aa318785d06ae0509e67504f9ba588ba69f46c4aba09

    SHA512

    0bf841db40ccefa0f5dc41f9e8b26e5a65d8cafc933ff0bd2aca2912915c8bbf6617585a6de46f5c026632f5db4f208aa841ffa0a5fa3f718e53f92815843064

    Download Submit

  • /data/data/ksevwua.slyhzcirx.dumbmg.qrnpbxep.ldeqj.yqcam/files/b
    Filesize

    446KB

    MD5

    a08eb40c8f41932cdfbb171b11047499

    SHA1

    640df821c78b575ddc1fb1ba3150795ae8a38af2

    SHA256

    21de04b706537eb676cda25497d25ce84e45d132232f715656f81c1e66ea4767

    SHA512

    03512be8115948dadefab3d4490e82fe8ebf5baa79765ecb63aec0b1ffa97c29ab37d68abf628e35ecb186ac1e81b2f259d392891eef2633707288803921442c

    Download Submit

  • /data/data/ksevwua.slyhzcirx.dumbmg.qrnpbxep.ldeqj.yqcam/files/oat/b.cur.prof
    Filesize

    1KB

    MD5

    d6fda1016bfee233b9c18e2d2f0f10ce

    SHA1

    7685e4cb4171c601284ca4a773177394e98daaf2

    SHA256

    0177084e32a284df96c972089929fe1465ce316edfb282ef10121459a872db8c

    SHA512

    f880eaf75ad92071c454413bcf9aa5aabaaa3e2963e3ee37ed904da2483c40462bd4349dbe4522816fa54e5007d0006c245e4f55dcaada7c86f097b1b6310e05

    Download Submit

  • /data/user/0/ksevwua.slyhzcirx.dumbmg.qrnpbxep.ldeqj.yqcam/app_picture/1.jpg
    Filesize

    7KB

    MD5

    3d250e54328b1eee2a37a366835d772c

    SHA1

    22e0b664d581c68a53bbe3c72d4b49506f77d2ad

    SHA256

    4796ac9c0c3cc2d0c35fd61b9afff677dc988144967a412c1742a77857497a1f

    SHA512

    080f2584aac4f071556feee0af14748ce96eb97c9f516b23fc984093a1cd79f127d5a230ba44198b36a1b3e86e04efe0ee49187ee3ae896753ed9405b5822255

    Download Submit

  • /storage/emulated/0/.msg_device_id.txt
    Filesize

    36B

    MD5

    83bdcb91cef68e0b328ceb0d1daed23b

    SHA1

    5952f00f68dfa4568015c746202f2316a4698d2f

    SHA256

    22851633e8df00d27cb7189c87910d01ee24a0f0e42854687d4224edd8ea15b7

    SHA512

    f439f6300df49ae81607eb7f62040d6de3839a0db35dade9ab0d454cff3f566ed3eb8b4068ec557b26a8ccdbfd6fdb444599afa4a37e1216e5aac0e1d8c896a5

    Download Submit