Analysis

  • max time kernel
    347496s
  • platform
    android_x86
  • resource
    android-x86-arm
  • submitted
    05-08-2021 05:05

General

  • Target

    09586_Video_Oynatıcı.apk

  • Size

    2.6MB

  • MD5

    2a6df4abb0cfc7ab9fa51125b00c6757

  • SHA1

    2f418f5a0e63c5416708c3aa698e15e2b8671c0c

  • SHA256

    f6dbfb0b634288955450f2d779f0d17f9cfa0bf9499341909245156ccc9a1adc

  • SHA512

    c6accc51e38b2ed765d60eb439c66a48fab8be706bb04d34380154f90bf30b6bc6ed05a04566ed8e2a1557318cea5ca594fc2cc78aafc92d6621dad3cda0a1a1

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses reflection 1 IoCs

Processes

  • com.jcojmdvo.eqdlwqn
    1⤵
    • Loads dropped Dex/Jar
    • Uses reflection
    PID:4901
    • com.jcojmdvo.eqdlwqn
      2⤵
        PID:4931
      • /system/bin/dex2oat
        2⤵
        • Loads dropped Dex/Jar
        PID:4931

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/MultiDex.lock
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zip
      MD5

      a83befb48f3870046404e4d6db9110fd

      SHA1

      f374afbd643ab791b0bdf77d5b278a3f8edc29ff

      SHA256

      efe2c08abf24f7848c07dfa0caf46c1605b47787ee781f61fcb63d892270d84a

      SHA512

      9f3f3f58f78232981f662dd7ca7856323b4e925a7b2bf522131ad824ed518715d76e607679f881f5875abdf2f5e5fe90348f25b6734066c1e99a2659d83009a8

    • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zip
      MD5

      372c52c540cc4ef80ad26a172ad36075

      SHA1

      a393b8063382598cfd170591d546311ee691495a

      SHA256

      7841c5edf625fab9dd5ab3a22681da1e14545496a5eec1f7baabcd07ad9841ca

      SHA512

      da9a213b4d9f4916b38f36d40f689c37cb3a57926d55a80253e915700553933901bdc6ab848051d15b780f3531613b3f0ac834901393f4e11defa8f6d4b672f1

    • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zip.x86.flock
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex
      MD5

      9c861cfc19b86e6929cd077831779bb6

      SHA1

      f3815d9aba7272873617be3a0e04cb9df1a328b5

      SHA256

      c170e9e573b482d149a23fe78713c6e2cdbb61535ac14d5fd2645d8a15ffad1a

      SHA512

      dfd0bb0ba26087f47267e83970681200dea11c2bf4158af4dec9b33a436bbebaeaf47bb1b585788dcb16cd300ed207d2c0c2b674087552047a3bf4687e08dd36

    • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/oat/x86/base.apk.classes1.vdex
      MD5

      7d1b0c300e83de3683210cc957b4d774

      SHA1

      cfcba1a09e674960d6609da5110362f1da935e95

      SHA256

      0e848818155f3ba5668ac76c3fd927b4281f175ac4bed95a907b276b03dd59a7

      SHA512

      60b66289ec0cf9145021a77d17fcd4feba0e7c8d3d7e55c644cff81d024df5432f104fc981af96ffd12bd849a4a619486bcfb50523b39784614d85030f952287

    • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/tmp-base.apk.classes1610037005743609916.zip
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/multidex.version.xml
      MD5

      314351ef5977898cc3244eb41a5c5b6d

      SHA1

      4e00dafd07f11e058419283fa4fa284d743b4498

      SHA256

      45eef0d9c652edc8806a192c36c3c22821f0583e38b03bf7eeb7cb51c105dee2

      SHA512

      5c916e11809d6c62f0901d00d0a23cbfb9ec67338138164a1ecc1b60df2667d8fec7309f1b6d86b2aa5f0b02bc14c6716e2ac5929642e4578c65f52475f5e493

    • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/pref_name_setting.xml
      MD5

      45cbd6738d7a870796aba30907dcebba

      SHA1

      10e4a2c462c67ed8332818635106fae7c0f76cc6

      SHA256

      c636e2f121166ddd036ae1fbc3a9662cc4d90d8196a5bb7c60a47a19c924b064

      SHA512

      f01c5446acd91696c8f270178153d37acabecf8579ebde823972dacf35bbf87f9fbe4a9fefc243aa17c8a274ff669a8c9975bdb62d561850bad7401be5a66005

    • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/prefs30.xml
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e