General

  • Target

    83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff.bin

  • Size

    305KB

  • Sample

    250105-1z1rmszkhn

  • MD5

    54b1a1a9e2ba31c5a14185d1da28b84c

  • SHA1

    33a1be6f4459b84f2719c76ab15cb99f7cc8e783

  • SHA256

    83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff

  • SHA512

    c10c9181bcedccc8e66ceaa33c619543c97b253c7e9cf03296347465f942e4259102a7ce1932316d17e1c997734199c77b96cf3ab138f0b730f25a920703d59d

  • SSDEEP

    6144:wsONyeKf/SNBee3aeJXeqCKYtPVwmqNscZlCbeVyxCdxCa:wzxKf/STeeqe0KY5qKxhkB

Malware Config

Targets

    • Target

      83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff.bin

    • Size

      305KB

    • MD5

      54b1a1a9e2ba31c5a14185d1da28b84c

    • SHA1

      33a1be6f4459b84f2719c76ab15cb99f7cc8e783

    • SHA256

      83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff

    • SHA512

      c10c9181bcedccc8e66ceaa33c619543c97b253c7e9cf03296347465f942e4259102a7ce1932316d17e1c997734199c77b96cf3ab138f0b730f25a920703d59d

    • SSDEEP

      6144:wsONyeKf/SNBee3aeJXeqCKYtPVwmqNscZlCbeVyxCdxCa:wzxKf/STeeqe0KY5qKxhkB

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Xloader_apk family

    • Checks if the Android device is rooted.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests changing the default SMS application.

MITRE ATT&CK Mobile v15

Tasks