xloader_apk | d9adfdd2908fe30eeecb5443787d33d2dc9c4fe5c201665058261c6330af8c98

Analysis

max time kernel
148s
max time network
164s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
24/03/2025, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xloader.apk
Size

296KB
MD5

a196666d4aaaa6ae0ba9e498ffd8f65c
SHA1

085835b10dcbe5117547ac597ce24f3dd3fd283f
SHA256

d9adfdd2908fe30eeecb5443787d33d2dc9c4fe5c201665058261c6330af8c98
SHA512

dbc965bdad00d35545a069d7723be8c6d3124644886de2313fb4117109f113d4d55d196fda0305f4ef9b5a8761fa4611928dd075bec3fc689fa76ac18e57e894
SSDEEP

6144:UOH3U0QhDuC1Wx1+lJW1vsPlEczJaUHPNyWY1NHXPfY+TDBxW:hXUaQa+ls1EPl11dYWkN3PA+Te

Score

10^/10

xloader_apk banker collection defense_evasion discovery evasion infostealer persistence stealth trojan

Malware Config

Extracted

Family

xloader_apk

https://ajlkhadsflg.blogspot.com/?m=1

https://tuyolh.blogspot.com/?m=1

https://tyhdaou.blogspot.com/?m=1

Attributes

user_agent
Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

Signatures

XLoader payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Xloader_apk family
xloader_apk

Checks if the Android device is rooted. 1 TTPs 3 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.njyi.tvwb
/system/xbin/su	com.njyi.tvwb
/sbin/su	com.njyi.tvwb

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5077	com.njyi.tvwb

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.njyi.tvwb/files/dex	5077	com.njyi.tvwb
/data/user/0/com.njyi.tvwb/files/dex	5077	com.njyi.tvwb

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of the MMS message. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://mms/	com.njyi.tvwb

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.njyi.tvwb

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.njyi.tvwb

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.njyi.tvwb

com.njyi.tvwb
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5077

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.njyi.tvwb/files/dex

Filesize
482KB

MD5
596227101999c7b6a2259f1bdd57997a

SHA1
81bc0f0e305bebfac09c06784f5ecf7a26b05f37

SHA256
bc2b4b4143615f87f5604b494ceae969b04051cc995e4d371fdeb3966b713344

SHA512
dbb13d983c7231acd5fff598584ac1206e362a5a2d90cedc51184208d7d119f077c8bf1885caa11d90b456a3ba73bd9b2ee99694d328e313f144047b7ba0c7ad

Download Submit
/data/data/com.njyi.tvwb/files/oat/dex.cur.prof

Filesize
787B

MD5
8fb620dd35cc74590e916dca6a732fac

SHA1
d0eea0cdeeba5e23a9caed440a0441d3f4fe31fc

SHA256
263404bf1ccb50ba1d4b7672b2a5268a1a3edd0961c58255d4be28a3adfb65f1

SHA512
40802889af766153361ab8c14fc54fa32707e417c32714493ab0aa0e81a5708b0c520b062f1b3b0eebd59c4156136d7fb349cfec8c16527c2eff70583ee6350f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads