xloader_apk | 3c6c974c8e3d600f024048d787c70487a8deb36b2aba81f1559bbed2667dcb15

Analysis

max time kernel
149s
max time network
145s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
09-11-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c6c974c8e3d600f024048d787c70487a8deb36b2aba81f1559bbed2667dcb15.apk
Size

209KB
MD5

6d36a7b76907b79174d930e5d44d4384
SHA1

e9b3d53658b35ccb0f7ed36138356cc9aa37672c
SHA256

3c6c974c8e3d600f024048d787c70487a8deb36b2aba81f1559bbed2667dcb15
SHA512

a28c47d3c36e9219f922e4cb0897c43c73b01198e669c7e690604cc17bd7a7fa9b0804c78c9589e2d757f59ecb3a67093daf29926f659d6bfac6609ea67c4f35
SSDEEP

6144:9kN/zsbLltB/kHtakQYR9WXuPno/7d2Vt5:iYLZ8XTiXjzd2Vt5

Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

Malware Config

Signatures

XLoader payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/p.mvcc.gqu/files/d	family_xloader_apk
/data/user/0/p.mvcc.gqu/files/d	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Xloader_apk family
xloader_apk
Checks if the Android device is rooted. 1 TTPs 1 IoCs
evasion

System Information Discovery
T1426

Processes:

p.mvcc.gqu

ioc process

/system/bin/su p.mvcc.gqu
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

p.mvcc.gqu

pid process

4525 p.mvcc.gqu
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

p.mvcc.gqu

ioc pid process

/data/user/0/p.mvcc.gqu/files/d 4525 p.mvcc.gqu
/data/user/0/p.mvcc.gqu/files/d 4525 p.mvcc.gqu
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads the content of the MMS message. 1 TTPs 1 IoCs
collection

SMS Messages
T1636.004

Processes:

p.mvcc.gqu

description ioc process

URI accessed for read content://mms/ p.mvcc.gqu
Acquires the wake lock 1 IoCs

Processes:

p.mvcc.gqu

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock p.mvcc.gqu
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

p.mvcc.gqu

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground p.mvcc.gqu
Requests changing the default SMS application. 2 TTPs 1 IoCs
collection impact

SMS Messages
T1636.004

SMS Control
T1582

Processes:

p.mvcc.gqu

description ioc process

Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT p.mvcc.gqu

ioc	process
/system/bin/su	p.mvcc.gqu

pid	process
4525	p.mvcc.gqu

ioc	pid	process
/data/user/0/p.mvcc.gqu/files/d	4525	p.mvcc.gqu
/data/user/0/p.mvcc.gqu/files/d	4525	p.mvcc.gqu

description	ioc	process
URI accessed for read	content://mms/	p.mvcc.gqu

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	p.mvcc.gqu

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	p.mvcc.gqu

description	ioc	process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	p.mvcc.gqu

p.mvcc.gqu
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
PID:4525

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

SMS Control

T1582

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/p.mvcc.gqu/files/d

Filesize
453KB

MD5
b602d3dd3d562ee250af4715acb76b79

SHA1
c91c7127394a5f02e3e4e2218cf4892f1ea2469b

SHA256
8d1949b83619b04679cf91d2918dc6f723f84a459ef4ff66546f0e2baf5aa849

SHA512
bad4e2089662a4440c763a06f91ece9485e57857d9bc2c4dbcb908d0c935ae7903ac0adca8506020680e5c52c8294c013bdeaff2ef7a3fdbaa5b299c6e94dedc

Download Submit