General

  • Target

    9c69172ca00d3f5bdc0aab5da4fbc22967412557898ba3628523ee74287827b4.bin

  • Size

    207KB

  • Sample

    241113-1zpz5szhnr

  • MD5

    bc3abe4e5b179df800da7126beaafaff

  • SHA1

    6308bed1167ef11e44af55b7bd96be340b60028b

  • SHA256

    9c69172ca00d3f5bdc0aab5da4fbc22967412557898ba3628523ee74287827b4

  • SHA512

    96d1d93ebcb58fdde5b72e88bbc96fe6d13bb6d256c1591337bc7c14d7b9041e52dcda0e7b25b223da36e92ea2e11e3a778e93f72823ab6afd955748a44852f1

  • SSDEEP

    3072:h4PwhdkSj9O8EEX5omzR+QXkhJCN48ZAC1m0gCjkDOKH41Kr6feQ1VO78jj6hAXo:hThq8ba4/0XC/ZFbI0R2+E7MiACFYBe

Malware Config

Targets

    • Target

      9c69172ca00d3f5bdc0aab5da4fbc22967412557898ba3628523ee74287827b4.bin

    • Size

      207KB

    • MD5

      bc3abe4e5b179df800da7126beaafaff

    • SHA1

      6308bed1167ef11e44af55b7bd96be340b60028b

    • SHA256

      9c69172ca00d3f5bdc0aab5da4fbc22967412557898ba3628523ee74287827b4

    • SHA512

      96d1d93ebcb58fdde5b72e88bbc96fe6d13bb6d256c1591337bc7c14d7b9041e52dcda0e7b25b223da36e92ea2e11e3a778e93f72823ab6afd955748a44852f1

    • SSDEEP

      3072:h4PwhdkSj9O8EEX5omzR+QXkhJCN48ZAC1m0gCjkDOKH41Kr6feQ1VO78jj6hAXo:hThq8ba4/0XC/ZFbI0R2+E7MiACFYBe

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Xloader_apk family

    • Checks if the Android device is rooted.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests changing the default SMS application.

MITRE ATT&CK Mobile v15

Tasks