Overview

overview

10

Static

static

6

4421a91228...49.apk

android-9-x86

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    30-12-2024 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4421a9122899400470925d5d950a102a0fc47a279051217e18456be09c61ca49.apk

  • Size

    260KB

  • MD5

    bdb40209c8128cc0f1763d6ec94a3565

  • SHA1

    4303228bc813e46e1df2619fa6a514141c291855

  • SHA256

    4421a9122899400470925d5d950a102a0fc47a279051217e18456be09c61ca49

  • SHA512

    278a358acd44856a3c5b8a94586b626b888e683d5899e73ea511c6ef977999029349579f0e65300510ceff1680599f0b8f514f89af7e589e6975aba5c7191b61

  • SSDEEP

    6144:L6asRfXHMwvgNBAoHu8HGLoAFjjeepAb5nwg6C4NO1:tcf3MM0A8mFfemY5wg6C4NO1

Score
10/10
xloader_apkbankercollectiondiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Signatures

  • XLoader payload 1 IoCs
  • XLoader, MoqHao

    An Android banker and info stealer.

    trojaninfostealerbankerxloader_apk
  • Xloader_apk family
    xloader_apk
  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
    evasion
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads the content of the MMS message. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • kicvnpn.nhtswpihe.tdncck.ebpycfiq
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    PID:4341
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/kicvnpn.nhtswpihe.tdncck.ebpycfiq/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/kicvnpn.nhtswpihe.tdncck.ebpycfiq/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4368

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/kicvnpn.nhtswpihe.tdncck.ebpycfiq/app_picture/1.jpg
    Filesize

    7KB

    MD5

    52be8811fb51c2f2e7c90e388e11e3ae

    SHA1

    f52e6ae69a7e06c153731244d6f3dd04bdffeb6e

    SHA256

    86aced1555eea65a7843428ac4326b4d9aa93c3e8c707dfc5ed6f9665384b984

    SHA512

    4d97bfef6605d293c85fff0aeb49e9b01ca6f0336f1e6def20463bca54b695f6f51a0136ecdfe7cbcf0ff194e86ee45b7213620258183b6ad811f3f46682074a

    Download Submit

  • /data/data/kicvnpn.nhtswpihe.tdncck.ebpycfiq/files/b
    Filesize

    446KB

    MD5

    3e04a3b314779ab7b515b04648084b64

    SHA1

    4b76a4fb951eb54b6c8593f50f4b7cc58b2997f1

    SHA256

    d24fc9979ea6d5e9a278ac59c422f3b189adbe5671a3be0f8e44c52a50af78b7

    SHA512

    cc87dbada39c5c2396c105d0a7dc9351ef70621261f5a892ecee526b4eac769e721f97ec1913f37dc092d46393c0f6a5d75dfb43fdcb6270236fa8a633ffe984

    Download Submit

  • /data/user/0/kicvnpn.nhtswpihe.tdncck.ebpycfiq/app_picture/1.jpg
    Filesize

    7KB

    MD5

    d75e0eebd8f6e0b21b9390c9ae9e9fe4

    SHA1

    af97786eff21c0a972483e611f6f7af133dfeb7d

    SHA256

    ae261d6d3e26a07894bebb3e465763361af7dab4dc6d9aced46097973d0f5d97

    SHA512

    772e37f955633e7c0df48f25b51d23cf5940900282a1594d8e8e3bbdd6204dacdf0b9773e079da2a9ab2dc8b532492c91ea9af78c5b954af5c6bfd7a727adfbb

    Download Submit