xloader_apk | 17d0e72794c4f554ffce5ba85a5a43881a8b425bdbb6bc415506d3efda8865f6

General

Target

17d0e72794c4f554ffce5ba85a5a43881a8b425bdbb6bc415506d3efda8865f6.apk
Size

212KB
MD5

2d08af2d90d4369d08e03568644ff445
SHA1

da3d88bf9f8f7ab53bcbc3061c740231c537a80c
SHA256

17d0e72794c4f554ffce5ba85a5a43881a8b425bdbb6bc415506d3efda8865f6
SHA512

9ae736864c706dec27d33cabcbb546b1198eee41d38fa9582d68cc7965647cec20448d6974520281edd955b6881e78f56479ac8d269d03d1570dc68803f36e7e
SSDEEP

6144:c5abm6JnD7TA7LYCJkuR2OLz5+5oy+jIZ9:zJDnA76utL45xGIZ9

Score

10^/10

xloader_apk banker collection defense_evasion discovery evasion infostealer persistence stealth trojan

Malware Config

Extracted

Family

xloader_apk

C2

https://m.vk.com/id730148259?act=info

https://m.vk.com/id730149630?act=info

Attributes

user_agent
Mozilla/5.0 (Linux; Android 8.0.0; SM-G955U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Mobile Safari/537.36 Edg/112.0.0.0

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36

Signatures

XLoader payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-5.dat	family_xloader_apk2

XLoader, MoqHao
An Android banker and info stealer.
trojan infostealer banker xloader_apk
Xloader_apk family
xloader_apk

Checks if the Android device is rooted. 1 TTPs 3 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.z.cloud
/system/xbin/su	com.z.cloud
/sbin/su	com.z.cloud

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4215	com.z.cloud

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.z.cloud/app_picture/1.jpg	4215	com.z.cloud
/data/user/0/com.z.cloud/app_picture/1.jpg	4215	com.z.cloud
/data/user/0/com.z.cloud/files/b	4215	com.z.cloud
/data/user/0/com.z.cloud/files/b	4215	com.z.cloud

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of the MMS message. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://mms/	com.z.cloud

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.z.cloud

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.z.cloud

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.z.cloud

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.z.cloud

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.z.cloud

com.z.cloud
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the content of the MMS message.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4215

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Hide Artifacts

2

T1628

Suppress Application Icon

1

T1628.001

User Evasion

1

T1628.002

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Protected User Data

1

T1636

SMS Messages

1

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.z.cloud/app_picture/1.jpg

Filesize
6KB

MD5
b128043f06d40ecb2ec7b890c72deae7

SHA1
4fee7474fe455e80a09f056cf904cebfcd02e322

SHA256
7507f5c0511f69e6ce2d5c6617981323176dbb9b60289ff3d732d6e9520bca83

SHA512
eb0ebbbae532291920adedb9410123385a073cf125c44c30ec921ac03f32e65b1ec9462f3d7a27a6be9494f6d774217d32aed3ce7dfad7469a96fe369b8b9afc

Download Submit
/data/data/com.z.cloud/files/b

Filesize
299KB

MD5
357a53368040d22d96b7e3b76d78acc2

SHA1
1aba03c7bc597a1da89eabcc529f4c69f690d25e

SHA256
52f386c68ad08a7081bbe500a16214f8595db85459ecff7fd36ee70d5052775c

SHA512
9bd5888e22d0db03ec8d9275446bb4cad086cdf6f4e1a8e4b625a44b63d9403d88fb2d17459eac3ff03cefaff59b1b42cf68074b66d6e31f70a55c24ac835a32

Download Submit
/data/data/com.z.cloud/files/oat/b.cur.prof

Filesize
431B

MD5
bfb056a0799a9fbf56e13d16d859f37b

SHA1
2dc356b6e5757b4a8f570a1d7a16ee7fc7dcf8d1

SHA256
0192a8bd5fe96670ea11b585472d346e52baf1b5959ec2bf8a8bfa424ca58647

SHA512
77ab586b0f66a3f97da2fc16c31d32fd5989cdbb7c0598f3634dc7cd7cbeb5e74eaeedab24629148b5d744777596958766e0b23aece75897fd71743e6b830502

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads