xloader_apk | 813c72455eb59b68de7ff404c523932990537ee2105a322c9a899eabcd2d886b

Analysis

max time kernel
149s
max time network
152s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
14-11-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

813c72455eb59b68de7ff404c523932990537ee2105a322c9a899eabcd2d886b.apk
Size

284KB
MD5

06bc45fe8db000c2ff81b0e270ceff7e
SHA1

0201c34ac5b12426612a917d9318b78d3f6f8f1c
SHA256

813c72455eb59b68de7ff404c523932990537ee2105a322c9a899eabcd2d886b
SHA512

03d4fd3e1f8f30a953b7b30d20dc3de57a1436dcdbb99f17287d7dbf68981f62fd71fd52ecc850a86cf435f488aaf1e28b56506d02dc20c50bd2e833169bd9ce
SSDEEP

6144:1EoZv/4FdNeaLBIzk/C+91YOYRw2SjFOIsUJ3Cu9Zstg+Q1:99mUaLgmxJ1O3RNtg+Q1

Score

10^/10

xloader_apk banker collection discovery evasion impact infostealer persistence trojan

Malware Config

Signatures

XLoader payload 2 IoCs

resource	yara_rule
behavioral1/memory/4336-0.dex	family_xloader_apk
behavioral1/memory/4336-0.dex	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Xloader_apk family
xloader_apk

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	htl.aczn.zfbgv.sx

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/htl.aczn.zfbgv.sx/files/b	4336	htl.aczn.zfbgv.sx

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of the MMS message. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://mms/	htl.aczn.zfbgv.sx

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	htl.aczn.zfbgv.sx

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	htl.aczn.zfbgv.sx

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	htl.aczn.zfbgv.sx

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	htl.aczn.zfbgv.sx

htl.aczn.zfbgv.sx
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4336

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

SMS Control

T1582

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/htl.aczn.zfbgv.sx/files/b

Filesize
510KB

MD5
e78e54c511f363e16361b31d4f2bd0d1

SHA1
9ea1ede17b83e205727373ad25dd7118303b8305

SHA256
6f19e8030ba87c91a898e9abff4115d4421ad00a90e7dd372f119cb6e7ef8af9

SHA512
311dab96666faa61e5a42c10fb26d65ca1bb37646a28c53a3ead121a2f4f8daff0d10237ffef798e091c18ba7dca631e3f1f1fafd4b3943675fdfaa73846f087

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads