Analysis
-
max time kernel
149s -
max time network
133s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
12-11-2024 22:04
General
-
Target
e716bad4910bf86b8879d9e3b3850cda9c3545a3dc83d096948a47d6a7b5e550.apk
-
Size
288KB
-
MD5
b00b9b9360331a8066931934cd88fc26
-
SHA1
1adcaf0afa08d5b49ec23382899539c3555270af
-
SHA256
e716bad4910bf86b8879d9e3b3850cda9c3545a3dc83d096948a47d6a7b5e550
-
SHA512
989600bd76d896345cfc6b046d3e0e2375412c7debe9e9ad73ec7f983a190204832f38a74d552783930740dcf5ac131ab35b863334dd1f6bcb3c42676a05f46c
-
SSDEEP
6144:AKJ7r1V32l3IeWQUktM7SedNDGFOkmep0DpDWScMZeBBxnf7Ucpzq9R+Bo8/y5Y:rnH3SYeWqtM7VAmLJW1TRc9sC5Y
Malware Config
Extracted
xloader_apk
http://36.231.70.96:28856
Signatures
-
XLoader payload 2 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
ayq.tjk.xhzu.sowc1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
509KB
MD5949d963c3c9097ef6dc4be634ff90762
SHA1c888376f3e299c7eb9718803926f4200c5d0ba0a
SHA2565836b3ce3820b9bd8b0ccf5438f66ca083f84c04b717af23163ee50903935867
SHA51230cc6ecab7953c64f1883e5156a87e80f2c342143e552872d0fca4624f95da4f7c4a024f38ed2380963897a7c788ad202a067d97602f61155e500ebe292f2c43