Malware Analysis Report

2025-01-19 05:00

Sample ID 241223-1ykzsssrdp
Target 3e28b0f168c0bbff137ea3d07a9884dc5dacd19b1056ac74c343bb0a3d79b64b.bin
SHA256 3e28b0f168c0bbff137ea3d07a9884dc5dacd19b1056ac74c343bb0a3d79b64b
Tags
xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3e28b0f168c0bbff137ea3d07a9884dc5dacd19b1056ac74c343bb0a3d79b64b

Threat Level: Known bad

The file 3e28b0f168c0bbff137ea3d07a9884dc5dacd19b1056ac74c343bb0a3d79b64b.bin was found to be: Known bad.

Malicious Activity Summary

xloader_apk banker collection discovery evasion impact infostealer persistence stealth trojan

Xloader_apk family

XLoader payload

XLoader, MoqHao

Checks if the Android device is rooted.

Removes its main activity from the application launcher

Queries the phone number (MSISDN for GSM devices)

Loads dropped Dex/Jar

Queries account information for other applications stored on the device

Reads the content of the MMS message.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Makes use of the framework's foreground persistence service

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests dangerous framework permissions

Acquires the wake lock

Declares services with permission to bind to the system

Attempts to obfuscate APK file format

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-23 22:03

Signatures

Attempts to obfuscate APK file format

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application a broad access to external storage in scoped storage. android.permission.MANAGE_EXTERNAL_STORAGE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-23 22:03

Reported

2024-12-23 22:06

Platform

android-x86-arm-20240910-en

Max time kernel

149s

Max time network

160s

Command Line

abccjog.agaerdode.vnpxyh.dqxjpgpu

Signatures

XLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

XLoader, MoqHao

trojan infostealer banker xloader_apk

Xloader_apk family

xloader_apk

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/bin/su N/A N/A
N/A /system/xbin/su N/A N/A
N/A /sbin/su N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/abccjog.agaerdode.vnpxyh.dqxjpgpu/app_picture/1.jpg N/A N/A
N/A /data/user/0/abccjog.agaerdode.vnpxyh.dqxjpgpu/app_picture/1.jpg N/A N/A
N/A /data/user/0/abccjog.agaerdode.vnpxyh.dqxjpgpu/app_picture/1.jpg N/A N/A
N/A /data/user/0/abccjog.agaerdode.vnpxyh.dqxjpgpu/files/b N/A N/A
N/A /data/user/0/abccjog.agaerdode.vnpxyh.dqxjpgpu/files/b N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccounts N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the content of the MMS message.

collection
Description Indicator Process Target
URI accessed for read content://mms/ N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

abccjog.agaerdode.vnpxyh.dqxjpgpu

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/abccjog.agaerdode.vnpxyh.dqxjpgpu/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/abccjog.agaerdode.vnpxyh.dqxjpgpu/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 m.vk.com udp
RU 93.186.225.194:443 m.vk.com tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
GB 216.58.201.110:443 tcp
GB 216.58.201.110:443 tcp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
GB 142.250.187.196:443 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp
KR 91.204.226.54:28899 tcp

Files

/data/data/abccjog.agaerdode.vnpxyh.dqxjpgpu/app_picture/1.jpg

MD5 acfca980496573160c4b625623cc17b5
SHA1 64a877ccf33123e1f30c22a4a10945a9f4cc0069
SHA256 efbeecc03865458ceba0536a118f1bb5af96f0666200c4c946239b70ae6fcfbb
SHA512 4433ce15c21a5eb0651318023a07d21d8c6b6a84d3b24f44c3de0fbdfa6365974a6105d4e8466dfe85d09ba847c9e79893a7d161a0f2ecfc27b8b74631dc8bf9

/data/user/0/abccjog.agaerdode.vnpxyh.dqxjpgpu/app_picture/1.jpg

MD5 5b2546c1bfb418a9ad86fb6049e76de2
SHA1 660c0d8ed7794b94d7dd3ff17094237f3b891c86
SHA256 bd8deb3416fc0f5a2ca244e0f3251d1140695b1809de39fbee1b956cc50f462e
SHA512 1b17fae141be29dd3911de3cac53c862c7457ba66999410fca7334ddcf4ddb117a720f4ed380268252e5944e96700fbd8dd9076afc66159c325e85af5b144124

/data/data/abccjog.agaerdode.vnpxyh.dqxjpgpu/files/b

MD5 3e04a3b314779ab7b515b04648084b64
SHA1 4b76a4fb951eb54b6c8593f50f4b7cc58b2997f1
SHA256 d24fc9979ea6d5e9a278ac59c422f3b189adbe5671a3be0f8e44c52a50af78b7
SHA512 cc87dbada39c5c2396c105d0a7dc9351ef70621261f5a892ecee526b4eac769e721f97ec1913f37dc092d46393c0f6a5d75dfb43fdcb6270236fa8a633ffe984

/storage/emulated/0/.msg_device_id.txt

MD5 753f9fda341c04964a09b259ca9f3411
SHA1 a6406c5e72ea6b4773fade3bdb68176afc6c9965
SHA256 55dcdb7bef678920ff9ffa2f6d5d6a0d40059c1752cd84e08308ad59e7055eee
SHA512 b749fe5ec375586501c54e99ffa27522d1de3de8ee5e7fc4c07d7d124d98fe54f22e05dcc615c64a24066d802a9774f834e44f390dc15e04e0b5b26dd150c707

/data/data/abccjog.agaerdode.vnpxyh.dqxjpgpu/files/oat/b.cur.prof

MD5 aa93cf83df7b371be98d28d2851e8930
SHA1 a6e67b7f2005401995b466d1445bd3e0aacc5c00
SHA256 d6b0d80ed97e8195259c9ad78762f0adf4cc89275fb8fba8fc677ac3a626f401
SHA512 c4fece82226352234c8ef674438a29da92c745c30923fcf7b0e5124a714f7738f18881c1348d1d957e8c31fe586b8ad6a9d86be696a2ca1565df92e81b8466c6