Analysis
-
max time kernel
149s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
10-11-2024 22:01
General
-
Target
eab9c00e9526f5ffd97f9be5541ef67008f0724b39c07931a52993d0e5131826.apk
-
Size
212KB
-
MD5
e4af2fa5e4518510c4c1991106a3e95f
-
SHA1
de4529c5ac6d78fdf0ecdff3bf21d3c44c01f97f
-
SHA256
eab9c00e9526f5ffd97f9be5541ef67008f0724b39c07931a52993d0e5131826
-
SHA512
7a0002088d78e5388f276d141b1ffe097df3dce7dd51100660b0e876d183f9a3c7915b622a1b096abdb86291432b4d988491dc919227710ad71c2f8d2bc520d9
-
SSDEEP
3072:tcF3Q0vg46W2XjkrIx9KJVaRIJvSYlETVmdtVIoHpwGw+fvsIMcJgcE5o2laB:tQa46W2TUIzmaRIJvLEsrpw/+ecpElaB
Malware Config
Extracted
xloader_apk
http://91.204.226.54:28899
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
plyhaeg.thhjgyymp.sfdodj.cbpalbis.xtfqx.omlna1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/plyhaeg.thhjgyymp.sfdodj.cbpalbis.xtfqx.omlna/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/plyhaeg.thhjgyymp.sfdodj.cbpalbis.xtfqx.omlna/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5b3035fb21aafdc4ff90fdf0fea85a5d9
SHA169f5903b790529c4406f268e29249e8f8905a6f8
SHA2568ae70663ff1ab94e55c3b08af982087d05c92d47f749832d6e1b91da37bb7aab
SHA512d716b6517f471f8d8df5c04c0ca33c97caa707047ae8f25cb9c42b6d43e9e3ac615041d3fca3c5942ed552be237a12265540b48b71ff86bbdd6f814a3574210b
-
Filesize
446KB
MD5a08eb40c8f41932cdfbb171b11047499
SHA1640df821c78b575ddc1fb1ba3150795ae8a38af2
SHA25621de04b706537eb676cda25497d25ce84e45d132232f715656f81c1e66ea4767
SHA51203512be8115948dadefab3d4490e82fe8ebf5baa79765ecb63aec0b1ffa97c29ab37d68abf628e35ecb186ac1e81b2f259d392891eef2633707288803921442c
-
Filesize
1KB
MD5806b27ec8f5916eaef518d4e6ab87331
SHA1d180cf3115ca658c213bfc69eb083d7e89b2bb15
SHA2567739bfc89cf8165bd4481f65ef8f04b825e8c9f88b2144ef0512d66aa627597d
SHA51272d995d860f06f46beed6ec52468a61e82cb4718edab7b297d10736bd52c2ca00a268ca8804e7433170dd84f7671e1efd689628d58863f201b9415f8ecb15fc0
-
Filesize
1KB
MD559c2721e8033659ae6835bd15b21a5b2
SHA1cdacb22286dcfeda1572ef8d3e5c16303e7d8520
SHA256b2b3d4cd3c266dbdce214560131922b554d52c702e8077b4e9f202775f543392
SHA5120050af17ce2ba0c6058a90e909edc4729e1a2abca443b722c43c7e80213c8ea764bac2480a1def887a07d5e3f00e288550df6879a6074e05afdc50d7baefadf2
-
Filesize
1KB
MD543c433ac2d227fbeaa357fe8edfd2603
SHA12f4294f2a287255985ab37e15055733345a9ab2f
SHA256eb79db477c3fa715856e6643caa6452aa5c31171bd186e5c6d6e36c23b24b898
SHA5123213be74bac3993ebc89b879c2a114251479ed91547e30149b854e67d661413743df053df06c72c08e270a12ce848acd9e8ff44e1f0dc8bb030135948f8dc6ff
-
Filesize
7KB
MD5d272ffb46063b29631f1cd3b53c423ac
SHA1ffb9308692bba64126ffb9a04e6acde186e4021f
SHA2567f31eafbc95dd6bbf96ad1b494d817ab8c6fe26757c0e184db8f3b0fcd35ef37
SHA51266dd495e89e2a3ff79ccecfa6690547ac8291c61f0e07e26c9e038dab6d2a37853c429f9fa1987cc92b94692671a37f5823af92ca7eaeec66b345f36555ee8d3
-
Filesize
36B
MD57cf1a4a91c2de09a8cd9a1c9b2575f85
SHA1ba849709c1ad44e354f153ce656f9fb11c214fd7
SHA2568fba5bc9f53fd51e30b330576bdb79043a550cbd11d00def35397c9e8dd9d6e0
SHA512c69711be8002d61ac9bbc3b4fc3832910d5b8c14611214e0dc30f11808c4facf97df4471be40e8e9a56523935424d87022259247aed601edfe16974e331725dc
