General

  • Target

    8f1d08ff7a074aa902819f50d6ed9d38f3ef56f687abb6e31269947387c2f488.bin

  • Size

    308KB

  • Sample

    241111-12gfsawrcw

  • MD5

    0614230281306c5d446adaa76afac6a3

  • SHA1

    b3e28d89d7d435af4693e327c0860053da1d4b47

  • SHA256

    8f1d08ff7a074aa902819f50d6ed9d38f3ef56f687abb6e31269947387c2f488

  • SHA512

    3ddaaf00ab6531ebdfb452547290072e95e43475bcf7d0b00707f54038677044a03b8a7265dda8a43ba5abec59eccce285cb0956ad261986e344e85ebbed28d7

  • SSDEEP

    6144:mHewOvaw8NpX/wA9tmtdXCmTeze4J7uc2hWAnFXMemm1ZLeB:MeZvl8NVIA9tmtdTIeCzAn1ZLeB

Malware Config

Targets

    • Target

      8f1d08ff7a074aa902819f50d6ed9d38f3ef56f687abb6e31269947387c2f488.bin

    • Size

      308KB

    • MD5

      0614230281306c5d446adaa76afac6a3

    • SHA1

      b3e28d89d7d435af4693e327c0860053da1d4b47

    • SHA256

      8f1d08ff7a074aa902819f50d6ed9d38f3ef56f687abb6e31269947387c2f488

    • SHA512

      3ddaaf00ab6531ebdfb452547290072e95e43475bcf7d0b00707f54038677044a03b8a7265dda8a43ba5abec59eccce285cb0956ad261986e344e85ebbed28d7

    • SSDEEP

      6144:mHewOvaw8NpX/wA9tmtdXCmTeze4J7uc2hWAnFXMemm1ZLeB:MeZvl8NVIA9tmtdTIeCzAn1ZLeB

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Xloader_apk family

    • Checks if the Android device is rooted.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests changing the default SMS application.

MITRE ATT&CK Mobile v15

Tasks