Analysis
-
max time kernel
149s -
max time network
146s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
10-11-2024 22:00
General
-
Target
f2443c330e99510afa923fc2a0f7799a0ed77ace87ed69b72457c099f76ebe73.apk
-
Size
458KB
-
MD5
8cdadd6b347509486f6d01891cf20f3a
-
SHA1
34e75e6faafc1f7eb9b35921e04ebc0d56b1205c
-
SHA256
f2443c330e99510afa923fc2a0f7799a0ed77ace87ed69b72457c099f76ebe73
-
SHA512
8b72f9dc345715d61bd507ff2587bb1421a0d0a8c9e710247820a0579adf8fc04d268b58096c96050ccfa772acc90be40544c40872f41a49d582cbc617fd686b
-
SSDEEP
6144:y7WG/VZ5FvJXGePMlzw6mXOi0JFHLyW+mrjfnpdkfTk3RxGqpnZeGLMpLm5xUueP:J2dfXGFu6oQ6WvfpafuwiZgpL6xU
Malware Config
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.geao.iiqs1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
ping -c 42⤵
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
782KB
MD581943f38b95891a341744d62af70fecb
SHA1f5e17b93b21e2d2907a1f4f1f3eba612c0f79fe1
SHA25613012f75645636977b362f60c3215f018092a02cb69db5fc0ba24f850fc034e8
SHA512bbe47a808c18120b67460b521bc487bf4ba7bb09efd85bcefbd2810b2dc8b74732b3eca5874e51db100465b4df116d09919862b381cba26c56c22fcee2080cbc
-
Filesize
836B
MD5d97ff4492338bc44f84c1b7974b69244
SHA1cea7dfdd8e30cf9a619941c7899c010cff1ea3c6
SHA2569cc1fd5040038d84d4bbaffd8ac3d629ae0e2de677421f36fa950e581750b097
SHA512e542bb4d465c5f6507c66f38ba0689cd3bcaa911fdcc986917ddf62d7a6baf2a530a7b91b9649518010b02302aa8e7efb99a72a51d4b6a7f07eca24e6b7786cd