Analysis
-
max time kernel
149s -
max time network
153s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
12-11-2024 22:07
General
-
Target
fb324ccf8ff6295e4f7ecbaf78c9b004d4fb6fcfdc13cb16d38b6f5ccd797ae6.apk
-
Size
272KB
-
MD5
21a71ebd735c81266564c02b353d7c05
-
SHA1
6722746ef23803f2662cd8249fcfc489088195b7
-
SHA256
fb324ccf8ff6295e4f7ecbaf78c9b004d4fb6fcfdc13cb16d38b6f5ccd797ae6
-
SHA512
977363502e71dd0b3c36f0ae2921bdb87b4e38562c849c8c08b2d2fa2584c6fbe2567eb732c7a5f3d7882619615330c1d9bcc13c1c48fb17d95187bc97398269
-
SSDEEP
6144:wBhKt18D9EskmNOBt9gBYEw5yIxCArF2QdVsLEY3i9VC9Jz3lNE:38D9EskmNOBt9gBE51Ddi49VC9JRG
Malware Config
Extracted
xloader_apk
http://91.204.226.54:28899
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
uwhnyzy.mnoyvitxr.zpgugf.zinwqzez.opurd.bzjjl1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/uwhnyzy.mnoyvitxr.zpgugf.zinwqzez.opurd.bzjjl/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/uwhnyzy.mnoyvitxr.zpgugf.zinwqzez.opurd.bzjjl/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD569b3e5fd5cf10102a92f3eb8e01c1821
SHA1a8ec23ce44382347a4089e5056a167841ac4f3ff
SHA256dcc0baa832976873f5dbefcc86d0edd5e643f150836a45d419a4e7ec01114769
SHA5127802482cc6a46197d18b87848dd3a1c1cca093941d9264e482c85c3468815b79b0c46ca39f8b6f39afb18e59617cb41fa2f5b34d29bf7633b68d1f65ba4f66fb
-
Filesize
446KB
MD5a08eb40c8f41932cdfbb171b11047499
SHA1640df821c78b575ddc1fb1ba3150795ae8a38af2
SHA25621de04b706537eb676cda25497d25ce84e45d132232f715656f81c1e66ea4767
SHA51203512be8115948dadefab3d4490e82fe8ebf5baa79765ecb63aec0b1ffa97c29ab37d68abf628e35ecb186ac1e81b2f259d392891eef2633707288803921442c
-
Filesize
1KB
MD5b89096097b020376066559a98eb8b9bd
SHA14983aeb8d6c637ce588f03fc349f937b3fd6cb32
SHA256b34761dcd57843df92a45cd111df09713b271132049480b8725090941bd4b619
SHA512939f2a6b791cfe492db50ba5776617292a6283086b515a20cb776ebbf3afb85c28f58dbd6dc447b103c1a4dac79c61b802841d4bd2d77a00f9df10502eeac4d4
-
Filesize
7KB
MD5a3121ed060eda45f7484598b6c17d3ac
SHA1e67b0038eda01c811ac157e40ed67a04879da6e6
SHA25688ff79da5806950e6976af0f9cc0e79ee4af16974270b774d2312a3abf479973
SHA512995823895806ed4e34cb1ae87dbf1c9bd6a09e571b580543631c5bd9ac7a5afbf07774c76954e88513bac2e9277feee376a35a823bd11548c9380aeb85e8f36f
-
Filesize
36B
MD508c9af9ca74140bcbe441e77d43429d1
SHA1e23cd16c0031c59f72335ee9b5ff4a00e21d8d52
SHA256ad78ed4a76e250969c73080ad2b6034ddd12b0e27fc31a2e04c9bc43cadb1b95
SHA5124cbd0583132ab892da6251bc8cf68cfe7dfa88340f3b8b088fd2dc2e8bb6584bf04eac0671bb1f2546155a1484209ae8453e5bfd6c3d7be446675576563d2866
