Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
10s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
25/12/2024, 22:11
General
-
Target
3a3e7f50b30cd3728b94101e7d675044f2259cd2ff429c7581d5ad20151c616f.apk
-
Size
212KB
-
MD5
639eb3c44df71c12df1186a6efc6b49a
-
SHA1
aa3d42f0378aa15cd563060594081f4534422e80
-
SHA256
3a3e7f50b30cd3728b94101e7d675044f2259cd2ff429c7581d5ad20151c616f
-
SHA512
0a70ae1e7d9b177ca8159e026d592150c95b87455f7d2bc0685d0675cfac003ee01f8c8037fac3940d40413874de31c04ab48e1ac225cfcac59bb922586ba57a
-
SSDEEP
3072:7lIzV//AapbWfPP5d7G3ASs7Dcgh9J3hH21Bvu4MiUDxML0vpN0GoY0UXPLcnCGB:WJnAaRKPniQpXc+9HW1puiU9MgPVWRf
Malware Config
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
yvakdgm.vhdsyrmwy.vgesgl1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5b9c3d28480fbebf34b9903da2b035483
SHA11c7222da1ff6eaafcfd18b8d04433a5dccebd76f
SHA256f9c4be5ad929febf81f2f0e919f8480eca37618dd45fbaae9040d63c3d1e6c9d
SHA5120ef8c3699adba7fb8879fca476ea3bee5f7bab775cab02fa2f26a4919c83f6d627d9f3e580bea0eab2de19e5eb969455d8e436003d7b0f43752be8f343fbb080
-
Filesize
446KB
MD55705e5b58e9503402cf66c15fbc1d854
SHA1ac943d94e87db55183a1cf24517c3d40361a2d03
SHA256c8e371d5021bc1f77ea2062c2a568ada090e464099596476536816b4feb1f5e8
SHA51246ed8f6f3a670ef3dbf0477353d3da5a19f3a188b51ee8cea492e3a6ffed77d14663eb1732bc084bdd78f4fea0a4190c39399a20aa2f6b6c92fc91bded97e70d
-
Filesize
8KB
MD5239bd951b05f2c81f0dbf6adce21a987
SHA184f45837a5f2d2c9cbb017d13187e9e88ebf045d
SHA2567278425486b99aa1044a90481dddb732572f45a315792d3121c6f41268f4921e
SHA51268ebfcc74501319356a7210b51ca766bce1e4a04be43d6034473c431118373dcfebba2895527c5da4df7ae5dbba972fe7fbba97d5a81778d83555cf5518c930d
