General

  • Target

    73a96101366093e1c39fcfed1dc374d3a93736d6bba471e6d33c895b6898d3e1.bin

  • Size

    260KB

  • Sample

    241128-117lksyjek

  • MD5

    f99911dd1c946c3d3ff01f5e0a6b1003

  • SHA1

    ba7f3829c5de7f6142334e2bb073f0cb39669d2b

  • SHA256

    73a96101366093e1c39fcfed1dc374d3a93736d6bba471e6d33c895b6898d3e1

  • SHA512

    6b36fac7523d6072a1c783546c30d0175a5a1b87539f21569ab3c83e9cb483e0a02c7261ce2cf069a0fdd3190b66b37d729f2529b76b4d02f2e18ef307d78c83

  • SSDEEP

    6144:eVt4RfBseeOoZTNBAo1u8HGLGAnjje4pqbpnwg6cQpb0QSY:C0fnNyq8AnfeM2pwg6cxLY

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.226.54:28899

DES_key

Targets

    • Target

      73a96101366093e1c39fcfed1dc374d3a93736d6bba471e6d33c895b6898d3e1.bin

    • Size

      260KB

    • MD5

      f99911dd1c946c3d3ff01f5e0a6b1003

    • SHA1

      ba7f3829c5de7f6142334e2bb073f0cb39669d2b

    • SHA256

      73a96101366093e1c39fcfed1dc374d3a93736d6bba471e6d33c895b6898d3e1

    • SHA512

      6b36fac7523d6072a1c783546c30d0175a5a1b87539f21569ab3c83e9cb483e0a02c7261ce2cf069a0fdd3190b66b37d729f2529b76b4d02f2e18ef307d78c83

    • SSDEEP

      6144:eVt4RfBseeOoZTNBAo1u8HGLGAnjje4pqbpnwg6cQpb0QSY:C0fnNyq8AnfeM2pwg6cxLY

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Xloader_apk family

    • Checks if the Android device is rooted.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries account information for other applications stored on the device

      Application may abuse the framework's APIs to collect account information stored on the device.

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks