General

  • Target

    f8ab7dec081dbbddf41a4b4b4dabff2bf662e69dc48255275e06dd9701592006.bin

  • Size

    306KB

  • Sample

    241112-1zqaxa1nfs

  • MD5

    ca7d7c88be95b99ec6c0e46caf992fc2

  • SHA1

    099ec868d9a1a85fffff3387fa3f2293ffe7f36f

  • SHA256

    f8ab7dec081dbbddf41a4b4b4dabff2bf662e69dc48255275e06dd9701592006

  • SHA512

    980228988fa6ccf376f057b4ca57bb052722e57cfa6ba591ac695a8a00d426c0252dfbc664c3059dc7a988d4665edb03e7eed0697456da770fd3de5e348ca62f

  • SSDEEP

    6144:OGCkU6UM7yrCobJIPPXMk6fQkIcgvauFRmFNUZtauzGVmxJifqk1bdSu1NNg93In:OG7U6B7ye0S3XGfQ5vaemFNItVzGVmxA

Malware Config

Targets

    • Target

      f8ab7dec081dbbddf41a4b4b4dabff2bf662e69dc48255275e06dd9701592006.bin

    • Size

      306KB

    • MD5

      ca7d7c88be95b99ec6c0e46caf992fc2

    • SHA1

      099ec868d9a1a85fffff3387fa3f2293ffe7f36f

    • SHA256

      f8ab7dec081dbbddf41a4b4b4dabff2bf662e69dc48255275e06dd9701592006

    • SHA512

      980228988fa6ccf376f057b4ca57bb052722e57cfa6ba591ac695a8a00d426c0252dfbc664c3059dc7a988d4665edb03e7eed0697456da770fd3de5e348ca62f

    • SSDEEP

      6144:OGCkU6UM7yrCobJIPPXMk6fQkIcgvauFRmFNUZtauzGVmxJifqk1bdSu1NNg93In:OG7U6B7ye0S3XGfQ5vaemFNItVzGVmxA

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Xloader_apk family

    • Checks if the Android device is rooted.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests changing the default SMS application.

MITRE ATT&CK Mobile v15

Tasks