Analysis
-
max time kernel
347499s -
max time network
156s -
platform
android_x64 -
resource
android-x64-arm64 -
submitted
05-08-2021 05:05
Static task
static1
Behavioral task
behavioral1
Sample
09586_Video_Oynatıcı.apk
Resource
android-x86-arm
Behavioral task
behavioral2
Sample
09586_Video_Oynatıcı.apk
Resource
android-x64-arm64
Behavioral task
behavioral3
Sample
09586_Video_Oynatıcı.apk
Resource
android-x64
General
-
Target
09586_Video_Oynatıcı.apk
-
Size
2.6MB
-
MD5
2a6df4abb0cfc7ab9fa51125b00c6757
-
SHA1
2f418f5a0e63c5416708c3aa698e15e2b8671c0c
-
SHA256
f6dbfb0b634288955450f2d779f0d17f9cfa0bf9499341909245156ccc9a1adc
-
SHA512
c6accc51e38b2ed765d60eb439c66a48fab8be706bb04d34380154f90bf30b6bc6ed05a04566ed8e2a1557318cea5ca594fc2cc78aafc92d6621dad3cda0a1a1
Malware Config
Extracted
hydra
http://greysondowling458.xyz
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.jcojmdvo.eqdlwqnioc pid process /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zip 4372 com.jcojmdvo.eqdlwqn -
Uses reflection 3 IoCs
Processes:
com.jcojmdvo.eqdlwqndescription pid process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 4372 com.jcojmdvo.eqdlwqn Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4372 com.jcojmdvo.eqdlwqn Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4372 com.jcojmdvo.eqdlwqn
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
588e83008876f2f285eab4828a24f317
SHA139fcff812e3940acb6a90d7e5c337dfa71b3f223
SHA25691c854f41706550af73c3fe1279eb0b6a971cec172109b55f30dfe71ce451479
SHA512d34317ece6dd5242002309db8bc416a40d7bdf1faba71548cbb622b68394794e6eb476bb02a33a65f6501e251e31bacec05253a96ec4152d031bffa2aab5c44a
-
/data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/tmp-base.apk.classes608697551017772285.zip
MD5d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
31a7de7f72e4cd4f01f9711a73197163
SHA128be23cd944bbe3b00ed681cc29311b588411dbc
SHA25607aff015c7fabd11b2bb72f4e624e41dd8160120cfd37aabcd075516fdf1843c
SHA512adea7c9d37a63cc9dc3f621de3df81fc831a42b4e16f6003d65d5527f9c3fb8601dd345cd3049506c446bbea9ad6de7749bb55bed16f90c756f64e38048fa011
-
MD5
e9a2f22d372f0d4d47ef5411686c605d
SHA12a7453176ab028965301dfc3bba016e020af1fd8
SHA256655944a75bb4ca792fb17940f6841844e285e6eaeef8b63b1559fad1f6f653b9
SHA512864f1f761ee4b652a5cc5508f1deac0b8a3f0321ecfcbba288630edef74afe6cc72d7d4f462452c8a5752b6ff4f0b2bce3ca79ed564602d7696c39d0546d2d5b
-
MD5
25d5ed3ac0b125bd3264bb4fdd31824c
SHA1fda5b6307639bdc9dc10cc1199da9ce30979b526
SHA256207d572151cd74f4f27d29829524eb75248844e3d61bd88b44fb8ebb72ba79b4
SHA512e316f42e2732bfe118f3764b9f226907765e99e63973fb6eda11f5747ff432a98fb9c74c6fa5ec947a01227dce64e89e4ff8ac6d87b4c2957bdd7cead2bb83e1
-
MD5
1c6b6a6a91f2ccf7ac553f9a439ad69e
SHA1270b45bc1c3255f95fecf8bfa85f7dbfc8fb5748
SHA256a7958ee3107cac53056bac67328f317cf9e3aaf4533e1072f0c4f0334ebbffa6
SHA5128a61fcab1bc82977f72af693d4a749ad41df81a9a9c6eaafee0f4ffd36a34f069a259c6b20046a8bce58a6eab526df122cb82e8d093be73cf5ff9d41e489bf8e