Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system -
submitted
07/03/2025, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
c6e476cbfc46fc4e4908a51ee328c8702cf8f6a9353c692c2cac638325de1755.apk
Resource
android-33-x64-arm64-20240910-en
General
-
Target
c6e476cbfc46fc4e4908a51ee328c8702cf8f6a9353c692c2cac638325de1755.apk
-
Size
284KB
-
MD5
5c3d6975cafd8ca78347fb69a7e361df
-
SHA1
9d1e0c67288395e245c35313ba9c9f1a3387cd34
-
SHA256
c6e476cbfc46fc4e4908a51ee328c8702cf8f6a9353c692c2cac638325de1755
-
SHA512
e27084362c3667c691537ba9163643413c4139ac3e96f2e48c4da86fbe15f48393acb0828a806062474200cf6a357039c4cea6417236c1416e14bb59c4f996d7
-
SSDEEP
6144:nCBaugX0usLaONTrsGD4/urPlDVXxF6tfWB7qTV+BcE0D:CZg0usLTwaiQ91KfWBCE0D
Malware Config
Extracted
xloader_apk
https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic
https://m.vk.com/id728589530?act=info
-
user_agent
Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
Signatures
-
XLoader payload 2 IoCs
resource yara_rule behavioral1/memory/4518-0.dex family_xloader_apk behavioral1/memory/4518-0.dex family_xloader_apk2 -
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
ioc Process /system/bin/su alj.gaox.tpsxk.cuhq.yf.mbfm -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/alj.gaox.tpsxk.cuhq.yf.mbfm/files/b 4518 alj.gaox.tpsxk.cuhq.yf.mbfm -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://mms/ alj.gaox.tpsxk.cuhq.yf.mbfm -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock alj.gaox.tpsxk.cuhq.yf.mbfm -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground alj.gaox.tpsxk.cuhq.yf.mbfm -
Requests changing the default SMS application. 2 TTPs 1 IoCs
description ioc Process Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT alj.gaox.tpsxk.cuhq.yf.mbfm -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS alj.gaox.tpsxk.cuhq.yf.mbfm
Processes
-
alj.gaox.tpsxk.cuhq.yf.mbfm1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4518
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
509KB
MD556cdeb711771883abba58bf795547d6b
SHA1b8681cb2081046dc3c6effebd4aca20fa35833dc
SHA256e29751533b08a75674acdf64a56219c35364c62a4559e18ca941821c21af304d
SHA512079dcc4c8000f74de910b9477919b595315181531cb804587165d8ebed6777f86c0379eae4409804035870d1468b6101883acf35d394638afcd79163d41b4a4d