Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
11/03/2025, 22:05
Static task
static1
Behavioral task
behavioral1
Sample
5286e1d980ad21cf88050f853ae9786b01f827df326de6746c92ba43412de1a8.apk
Resource
android-x86-arm-20240910-en
General
-
Target
5286e1d980ad21cf88050f853ae9786b01f827df326de6746c92ba43412de1a8.apk
-
Size
164KB
-
MD5
3fd72ee2b169e444156b611a6c4f4384
-
SHA1
a0eadb2c204848b686d62c00578716733fc6ade1
-
SHA256
5286e1d980ad21cf88050f853ae9786b01f827df326de6746c92ba43412de1a8
-
SHA512
2a05625c82ed3faef33bed5d912b97b5694709308d9d6acb1ac17b495eae9489343ad4d9554e4b15d59d72ef337a8fdc2be94644e9b44532653ae4bdd004042a
-
SSDEEP
3072:pgFgdFuEIOmHOZVysC+A5+CBljscfhNY5bpfXC03ZOrurjdf2kmFmovFkKN2Pvwm:pgFgjPmOneBJffhNY5bpbZO6rwkxPB31
Malware Config
Extracted
xloader_apk
https://m.vk.com/id730148259?act=info
https://m.vk.com/id730149630?act=info
-
user_agent
Mozilla/5.0 (Linux; Android 8.0.0; SM-G955U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Mobile Safari/537.36 Edg/112.0.0.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Extracted
xloader_apk
http://91.204.226.54:28899
Signatures
-
XLoader payload 1 IoCs
resource yara_rule behavioral1/files/fstream-5.dat family_xloader_apk2 -
XLoader, MoqHao
An Android banker and info stealer.
-
Xloader_apk family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
ioc Process /system/bin/su bugelbw.aetylpfvd.wakgnw.foqvfkdf /system/xbin/su bugelbw.aetylpfvd.wakgnw.foqvfkdf /sbin/su bugelbw.aetylpfvd.wakgnw.foqvfkdf -
pid Process 4341 bugelbw.aetylpfvd.wakgnw.foqvfkdf -
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/bugelbw.aetylpfvd.wakgnw.foqvfkdf/app_picture/1.jpg 4341 bugelbw.aetylpfvd.wakgnw.foqvfkdf /data/user/0/bugelbw.aetylpfvd.wakgnw.foqvfkdf/app_picture/1.jpg 4367 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/bugelbw.aetylpfvd.wakgnw.foqvfkdf/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/bugelbw.aetylpfvd.wakgnw.foqvfkdf/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/bugelbw.aetylpfvd.wakgnw.foqvfkdf/app_picture/1.jpg 4341 bugelbw.aetylpfvd.wakgnw.foqvfkdf /data/user/0/bugelbw.aetylpfvd.wakgnw.foqvfkdf/files/b 4341 bugelbw.aetylpfvd.wakgnw.foqvfkdf /data/user/0/bugelbw.aetylpfvd.wakgnw.foqvfkdf/files/b 4341 bugelbw.aetylpfvd.wakgnw.foqvfkdf -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccounts bugelbw.aetylpfvd.wakgnw.foqvfkdf -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of the MMS message. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://mms/ bugelbw.aetylpfvd.wakgnw.foqvfkdf -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock bugelbw.aetylpfvd.wakgnw.foqvfkdf -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground bugelbw.aetylpfvd.wakgnw.foqvfkdf -
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS bugelbw.aetylpfvd.wakgnw.foqvfkdf -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver bugelbw.aetylpfvd.wakgnw.foqvfkdf -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal bugelbw.aetylpfvd.wakgnw.foqvfkdf -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo bugelbw.aetylpfvd.wakgnw.foqvfkdf
Processes
-
bugelbw.aetylpfvd.wakgnw.foqvfkdf1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4341 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/bugelbw.aetylpfvd.wakgnw.foqvfkdf/app_picture/1.jpg --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/bugelbw.aetylpfvd.wakgnw.foqvfkdf/app_picture/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4367
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5453bd5f9f5c31bd762dcecf141fc3803
SHA1b4afd4507aa4d21704a1fa54fdb1ca7433617348
SHA256c7ea049b22daf0aaabd20b834ae84001fa6c94f4e84ab264d72c50e93e11cdb1
SHA51275417c4657045d417ac8d69a4df33ff17f18e81ceb148846b0e6a3d23dfe4830fd09184a3fcce9fc335e5a335a306690435ae1ac8d37a17cbfba03b5075e1da9
-
Filesize
300KB
MD5f60877a1602c5eaf2c76739c48fece05
SHA17a4ca110ca810e1d5b458455f6800d5ffe313dad
SHA256d2e257a9eb736324f1cf91ba4aaf483fea82ee96ce9c499f16b4dab2879c0070
SHA512862a34c8ae8dc16f74c0e4b32ab5210700a7dffd3cdd78d0838db43e52a1cbaf5d1eebfc84ede67bffc5a4c8d0085ed45fca428a086a3aac595986553fb8e8b9
-
Filesize
759B
MD5dded856bab3a2e5ef4890344cba3332c
SHA1b9abbe7b7c663ee0d9fce3cb0a8c0501feb5ab8b
SHA256921ef6355f06c34223b3485dcbd9f78a490b454d98a24436dfd741bf6c03b1f2
SHA5128903092b30ed70313d41f17040f520e7ec2914e2de1b70c83a580ce1767487dc7663ff04fa04fa066aef1602e7d4ca9bbe786a6f066c337a7892fb3e4d661702
-
Filesize
6KB
MD538cb7d70f607c42b841a71d5b5cb4b27
SHA1c4fdfe47fa768591006665de24175694c97f25dd
SHA256b2810cba09636c73db3373fb8912bc0b684d4eea8c57a0e98ad74b4f902fb31b
SHA512eb0035bdfd290c55076bd698d5e736847d149f34e33d7b0c250d6e3c2be02c66cc67b04619b0423b2d651956a715f05936d202ea3ae9d8d5af5b2aaa75b71b35
-
Filesize
36B
MD59958d0edfe06082e9674cd181a24a990
SHA1024aac5b8b74b5a209d738280cae0c7eb30e88c6
SHA2568c0a191b8f89428f70371f96b8987cb4d968d11f986c1eaa1cb195988f943759
SHA512cef51368dad39e292f696cebc642f452c823ac7defbe3de6dffd69b8ebafe08c5f6a49d79be67260b14091507404e658b02e66a659604f83d38943e2f84f4c40