General

  • Target

    e28d25bf7c0c2e5f2a5f01d8bef05d7f0f2ae013e7240f1eb2997d7f74f6d289.bin

  • Size

    208KB

  • Sample

    240704-1zty4a1hjm

  • MD5

    669045708ec1ec87383ae52d1aa645cb

  • SHA1

    67982b1c19ada0f04b07b32b56a840f03bedff12

  • SHA256

    e28d25bf7c0c2e5f2a5f01d8bef05d7f0f2ae013e7240f1eb2997d7f74f6d289

  • SHA512

    9429590180c2a3330bfd5eab9b6abb866771a8c61a932457ac21dec7cf27eb24d5cb453cdacf8f9264fcf7eb44c645987011ab6ebeda51b20d707bb652439c04

  • SSDEEP

    6144:axc7j9suJCH0qQwuMwxTUM2661pCNv+IhiG6J5C:aoj9K7zuMwxTUkawpiJ5C

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Targets

    • Target

      e28d25bf7c0c2e5f2a5f01d8bef05d7f0f2ae013e7240f1eb2997d7f74f6d289.bin

    • Size

      208KB

    • MD5

      669045708ec1ec87383ae52d1aa645cb

    • SHA1

      67982b1c19ada0f04b07b32b56a840f03bedff12

    • SHA256

      e28d25bf7c0c2e5f2a5f01d8bef05d7f0f2ae013e7240f1eb2997d7f74f6d289

    • SHA512

      9429590180c2a3330bfd5eab9b6abb866771a8c61a932457ac21dec7cf27eb24d5cb453cdacf8f9264fcf7eb44c645987011ab6ebeda51b20d707bb652439c04

    • SSDEEP

      6144:axc7j9suJCH0qQwuMwxTUM2661pCNv+IhiG6J5C:aoj9K7zuMwxTUkawpiJ5C

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Checks if the Android device is rooted.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests changing the default SMS application.

MITRE ATT&CK Matrix

Tasks