Analysis
-
max time kernel
149s -
max time network
155s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
13-01-2025 22:09
General
-
Target
307dd09e31d6503e5244418272476ed07258c8579191b7bf9e65cbdb06e5256c.apk
-
Size
212KB
-
MD5
528e67c8da6d4d0c23c3f3bccae953d8
-
SHA1
acdf4a48e9db81820fb3cc485583695a891fb853
-
SHA256
307dd09e31d6503e5244418272476ed07258c8579191b7bf9e65cbdb06e5256c
-
SHA512
40c441e5a988896a2dee5af65309442dd6fbb0773eb87d5edbfbc5e39ae4021f1572e6c94ccb473945489976c596571d46ebd4e5e230b564ae1c3cb5b2e6da84
-
SSDEEP
3072:3Mx7CUyBClrKBmb0/a/ei3iutle3mfq4FG3koARfh3mGD6R2qbD6eff7H+3O:cx+ErFpmRu7fvG0Bh2GD6R2e6e37e3O
Malware Config
Signatures
-
XLoader payload 1 IoCs
-
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
bwnwnff.rzbgzzpms.joheoq.ecgpkdwp1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD539862841523b5df9709ee13fd88460d9
SHA123f7c3541bdc544fbc098bd38a8eacadbd789406
SHA2562d200a325f2a9332ac62819c3ac55da7280e58ea36c879dcadcfab06062cf50c
SHA51239b23433805b51c3d8e9ed115b844035853af194ab01f3aafdfe4aaca3c331c9e9101f35a78c6c49332d11ed22f15c9ba41591b0ba6c6fd1a1bc97eba981b381
-
Filesize
446KB
MD511a84e2abac900abbf3f4ba5cf50d1be
SHA167684ec3853d85063a507d16f2d68ebb608f2df1
SHA256b5a19dd0a05f68cc4ce6302fe14b763803d95353dfc832ddd6ba9445006f5349
SHA5129f6f9b0370494a361eb3b908bd9c06e3daf1a07779ca9eb1e83f0984087ae3bf5cd9b042ee37a16d112d3e6f1724cfc5515eaa168fadd200f7ffee882310adb4
-
Filesize
830B
MD52af3b7b57f8c3b2b31d1b5ae3549c67f
SHA16cd69e6a731a57ca8947f5583b384541d94074a3
SHA256a2a9dbbf50387604b0009066c59e557de0cad98e6315fd22cfc6cb95edc6282c
SHA512af6981569234ed7f915b4040d577ee81533c9c1e4c2ff62f0a6cee378088ab7cff9e4fdb75912259a469fd3d5ce122a9e8e1a83391428e4836382476af8ce25d
