General

  • Target

    c9fe8087dcba9abe891741205dd96fd80876672c14fde35ee7cc6c2898c3c82e.bin

  • Size

    307KB

  • Sample

    250105-1z13eazkhp

  • MD5

    a6102bf8ce06c07378f0b34161025457

  • SHA1

    e98651ff2f56b55b6c5e87bda77ae7f1535bb6b2

  • SHA256

    c9fe8087dcba9abe891741205dd96fd80876672c14fde35ee7cc6c2898c3c82e

  • SHA512

    338994e52b3c43135711fc8c2b8442d61f5d427ce9eed53faba3fe47bf3da0bda5e8aef5fdd7475f5120f2d072e3ae9539cc7d56e43daf661ef4495a7e7ba41f

  • SSDEEP

    6144:Ui5hNwK+nbbsuVWlVZV8Q15Ptk1mqNscZlCbeVyxCGKFh+KZ:Ui5huKebrVWTT8Q1R/qKxhj8

Malware Config

Targets

    • Target

      c9fe8087dcba9abe891741205dd96fd80876672c14fde35ee7cc6c2898c3c82e.bin

    • Size

      307KB

    • MD5

      a6102bf8ce06c07378f0b34161025457

    • SHA1

      e98651ff2f56b55b6c5e87bda77ae7f1535bb6b2

    • SHA256

      c9fe8087dcba9abe891741205dd96fd80876672c14fde35ee7cc6c2898c3c82e

    • SHA512

      338994e52b3c43135711fc8c2b8442d61f5d427ce9eed53faba3fe47bf3da0bda5e8aef5fdd7475f5120f2d072e3ae9539cc7d56e43daf661ef4495a7e7ba41f

    • SSDEEP

      6144:Ui5hNwK+nbbsuVWlVZV8Q15Ptk1mqNscZlCbeVyxCGKFh+KZ:Ui5huKebrVWTT8Q1R/qKxhj8

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Xloader_apk family

    • Checks if the Android device is rooted.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests changing the default SMS application.

MITRE ATT&CK Mobile v15

Tasks