Analysis
-
max time kernel
149s -
max time network
153s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
24-12-2024 22:06
General
-
Target
4c60340af1230e8e4dea86442c6b5ae5d4ddf46185be51cb7be99f324edaef0c.apk
-
Size
212KB
-
MD5
119eddadd2fb6730d53445c687bf487c
-
SHA1
3aec7d70513e3980ab2a8e6c1015034710dbe8a5
-
SHA256
4c60340af1230e8e4dea86442c6b5ae5d4ddf46185be51cb7be99f324edaef0c
-
SHA512
f1d660297ae8512d899ab7d8fbc2748c75bafdbe9afc6377ae0d3a7992cc926797f8f9d057d63e21ad5d25d6cb610bc908f7ffd0a693bb511affad48b0ef5d26
-
SSDEEP
3072:36tV//AapbWfPP5d7G3ASs7Dcgh9J3hH21Bvu4MiUDxML0vpN0GoY0UXeLcn3Czp:0nAaRKPniQpXc+9HW1puiU9MgPVWETm
Malware Config
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
cuekztd.nfdswwuvj.mqjqpn1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5f74c4d4de6597995a9ec71297d7727a4
SHA187e2cb0fb0270697b9d87d1a3003bfc6098dd564
SHA256bfe0b63dff5d1ca2c5895b774139dd2ea9faebaadedc0c05a1b6279c4f3f9a8d
SHA512832956445fa5159e939edf8b062bfe3d9f582a3ea7a2c0e6a4655344a299e7997d26bbb2a5da900f011d9bb74fca41ef778a2eea063b87e587dbc584390391fe
-
Filesize
446KB
MD55705e5b58e9503402cf66c15fbc1d854
SHA1ac943d94e87db55183a1cf24517c3d40361a2d03
SHA256c8e371d5021bc1f77ea2062c2a568ada090e464099596476536816b4feb1f5e8
SHA51246ed8f6f3a670ef3dbf0477353d3da5a19f3a188b51ee8cea492e3a6ffed77d14663eb1732bc084bdd78f4fea0a4190c39399a20aa2f6b6c92fc91bded97e70d
-
Filesize
8KB
MD5b2c87bb6f610249c734aa0f8b89b89d9
SHA1bfc6f454bd8d9c89294dd972c1527504ed53dab4
SHA2564593900df6e79557f66271572531d5ac08a6fb8321de872258067a6ad5081955
SHA512ecb21703bbfb4ee91942c36d0ce60c693a4319ffbb632e87e0e5f50dbf3e08530251be52da08ebaefb8ff2d2efb0acf223e96177c6ed06211ed4dc951d07ac6e
