General

  • Target

    70db2849fda57b771012313e9fe6d97159af8bb1e26b5b572f64ba694bdfe808.bin

  • Size

    302KB

  • Sample

    250120-14ed7ssjfn

  • MD5

    7a658d7749d9d575182df10649c7bf1b

  • SHA1

    a1ea329dc01b8db4d87d5f15865b789db9cd0699

  • SHA256

    70db2849fda57b771012313e9fe6d97159af8bb1e26b5b572f64ba694bdfe808

  • SHA512

    bff4888efc52f28924d9b2be3e79e2aa1fe691db7b970ccc7b22e1703f76eacc4030c41d7cabe708e02db810f4519bba103a2ceb5ae975278b0f8516b75bc1c0

  • SSDEEP

    6144:d+T5/hvQf9dawLcMezMBHcle7IxWuJru7sqfrpcmXYwZ291iaVIUs0Dmw:d+xhvSgwL6z2We7mFoXfNXYwZW1JIUsa

Malware Config

Targets

    • Target

      70db2849fda57b771012313e9fe6d97159af8bb1e26b5b572f64ba694bdfe808.bin

    • Size

      302KB

    • MD5

      7a658d7749d9d575182df10649c7bf1b

    • SHA1

      a1ea329dc01b8db4d87d5f15865b789db9cd0699

    • SHA256

      70db2849fda57b771012313e9fe6d97159af8bb1e26b5b572f64ba694bdfe808

    • SHA512

      bff4888efc52f28924d9b2be3e79e2aa1fe691db7b970ccc7b22e1703f76eacc4030c41d7cabe708e02db810f4519bba103a2ceb5ae975278b0f8516b75bc1c0

    • SSDEEP

      6144:d+T5/hvQf9dawLcMezMBHcle7IxWuJru7sqfrpcmXYwZ291iaVIUs0Dmw:d+xhvSgwL6z2We7mFoXfNXYwZW1JIUsa

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Xloader_apk family

    • Checks if the Android device is rooted.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests changing the default SMS application.

MITRE ATT&CK Mobile v15

Tasks