Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • submitted
    21/11/2024, 10:46

General

  • Target

    Chrome_up1732156036129.apk

  • Size

    260KB

  • MD5

    5f94eb0c15f0b754617892ee18d5d9a9

  • SHA1

    a52189767ebbb10ec4d156e0a8690042996db632

  • SHA256

    958c51388770404cf1ddb320263125b5694a0691c5c6755e21ea61db968bef63

  • SHA512

    a0d2faf81ccb18a3333d7284e792ff9cc8273aec5ef01d5c4979c1db989dddb192aff1a8185b5d94372c54706a93cc70d0df42560ad4a2c94b4cfa0fc390f471

  • SSDEEP

    6144:YeRFYEjMHI3Jh67jcbyRQKLuikTPm4C4mYGeeCYvMuj:yEjMIwjcbubYTO4ozvMc

Malware Config

Extracted

Family

xloader_apk

C2

https://m.vk.com/id730148259?act=info

https://m.vk.com/id730149630?act=info

Attributes
  • user_agent

    Mozilla/5.0 (Linux; Android 8.0.0; SM-G955U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Mobile Safari/537.36 Edg/112.0.0.0

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36

Extracted

Family

xloader_apk

C2

http://91.204.226.54:28899

DES_key

Signatures

  • XLoader payload 1 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

  • Xloader_apk family
  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • cxtlhrb.yqhckriql.tljreq.syuksgxe.tbwen.cpajk
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4485

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/cxtlhrb.yqhckriql.tljreq.syuksgxe.tbwen.cpajk/app_picture/1.jpg

          Filesize

          7KB

          MD5

          462068f688cda61b5316b2e01b4bf846

          SHA1

          9aef24f7392e1bccdbbbbfd99b32604a82913760

          SHA256

          b40032c82f9b19cf81d2589ad0bdb1889987ae7182ad74a8f92d920530e8e7c1

          SHA512

          9135ff753166fe309898f3b9171c4ccccf9d5dc2eeb82bb6b638ef8db22b004bac7ab7e8e9052200ed4d52fc14182f6c23d30c09f3321b358433902b77506cff

        • /data/data/cxtlhrb.yqhckriql.tljreq.syuksgxe.tbwen.cpajk/files/oat/b.cur.prof

          Filesize

          1KB

          MD5

          d43c6f104e91219a3685a44271642870

          SHA1

          c25c4ef6fe623af535d49716ff7c21e94eada040

          SHA256

          3ea12c2cc7767f605e3cb2294537664f56b5b21f888ab79b5d2652e27687e473

          SHA512

          f484bdafe199e9ef20b68f1b5eb3a5238700f9c6ca72fdd6ab1dbad66d2cfd4477601776a214c23fc2d7ba07e75cb0d5f53b8c17b19065e34701fe54472fd874

        • /data/user/0/cxtlhrb.yqhckriql.tljreq.syuksgxe.tbwen.cpajk/files/b

          Filesize

          446KB

          MD5

          3e04a3b314779ab7b515b04648084b64

          SHA1

          4b76a4fb951eb54b6c8593f50f4b7cc58b2997f1

          SHA256

          d24fc9979ea6d5e9a278ac59c422f3b189adbe5671a3be0f8e44c52a50af78b7

          SHA512

          cc87dbada39c5c2396c105d0a7dc9351ef70621261f5a892ecee526b4eac769e721f97ec1913f37dc092d46393c0f6a5d75dfb43fdcb6270236fa8a633ffe984