Overview

overview

10

Static

static

6

73a9610136...e1.apk

android-9-x86

10

Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    28-11-2024 22:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    73a96101366093e1c39fcfed1dc374d3a93736d6bba471e6d33c895b6898d3e1.apk

  • Size

    260KB

  • MD5

    f99911dd1c946c3d3ff01f5e0a6b1003

  • SHA1

    ba7f3829c5de7f6142334e2bb073f0cb39669d2b

  • SHA256

    73a96101366093e1c39fcfed1dc374d3a93736d6bba471e6d33c895b6898d3e1

  • SHA512

    6b36fac7523d6072a1c783546c30d0175a5a1b87539f21569ab3c83e9cb483e0a02c7261ce2cf069a0fdd3190b66b37d729f2529b76b4d02f2e18ef307d78c83

  • SSDEEP

    6144:eVt4RfBseeOoZTNBAo1u8HGLGAnjje4pqbpnwg6cQpb0QSY:C0fnNyq8AnfeM2pwg6cxLY

Score
10/10
xloader_apkbankercollectiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.226.54:28899

DES_key

Signatures

  • XLoader payload 1 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk
  • Xloader_apk family
    xloader_apk
  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
    evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • sqnwavg.tvgitvmkk.hlqeoz.ahatdhnh
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4258
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/sqnwavg.tvgitvmkk.hlqeoz.ahatdhnh/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/sqnwavg.tvgitvmkk.hlqeoz.ahatdhnh/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4283

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/sqnwavg.tvgitvmkk.hlqeoz.ahatdhnh/app_picture/1.jpg
    Filesize

    7KB

    MD5

    4fd884ca4d7b4edef939f376890a223f

    SHA1

    76984a6d22615f40011e474a0d733389bcb68e3a

    SHA256

    3789512c2aae0b16685f045d81e20b2d8c0080c354ec2e0647f7e1359cfaa151

    SHA512

    4371ff5dad8d7c82ad3945bf99c7c61186d99695283fa26d02945f19da96805646f7f759121bb86eb3f7cf751a0467056caf5b5227305a67e14786e9bfa995bb

    Download Submit

  • /data/data/sqnwavg.tvgitvmkk.hlqeoz.ahatdhnh/files/b
    Filesize

    446KB

    MD5

    3e04a3b314779ab7b515b04648084b64

    SHA1

    4b76a4fb951eb54b6c8593f50f4b7cc58b2997f1

    SHA256

    d24fc9979ea6d5e9a278ac59c422f3b189adbe5671a3be0f8e44c52a50af78b7

    SHA512

    cc87dbada39c5c2396c105d0a7dc9351ef70621261f5a892ecee526b4eac769e721f97ec1913f37dc092d46393c0f6a5d75dfb43fdcb6270236fa8a633ffe984

    Download Submit

  • /data/user/0/sqnwavg.tvgitvmkk.hlqeoz.ahatdhnh/app_picture/1.jpg
    Filesize

    7KB

    MD5

    a73f5a2be7f1d99652eb7d84033743b2

    SHA1

    d4151bef9f88e827f77e97112adcfc1d86264f37

    SHA256

    a6883e4477319cce50ba2bda1f9703ddee0990c4800fef8b47ef407cad828321

    SHA512

    c37d8d8b1301dc313d7a4bde940ca8837a12cb107ee9d1b3f8735dd346a940770cdf0850ebe16b82ab139440409233fdc567863c41a8f42f860f79007fca5a34

    Download Submit

  • /storage/emulated/0/.msg_device_id.txt
    Filesize

    36B

    MD5

    b3ff5120c84dfc879d1b25bd6f57b8c9

    SHA1

    7c7a5926bb8788a3046b3a2a4c151b03d8dc403d

    SHA256

    38f41fa3567b7b656e1186e238c2bf4827aabd01da1938bc5139f8743eb7a6f7

    SHA512

    cd96bd5e89fcb454546a4fc7b3c3b3a706f8a54aa97238cd82fb4c66576d334641ee2f5fb8c0233527b1ac2743fff778a4e4690a8b6d1eb10528d00430d4ce86

    Download Submit