Analysis
-
max time kernel
347490s -
max time network
37s -
platform
android_x64 -
resource
android-x64 -
submitted
05-08-2021 05:05
Static task
static1
Behavioral task
behavioral1
Sample
09586_Video_Oynatıcı.apk
Resource
android-x86-arm
Behavioral task
behavioral2
Sample
09586_Video_Oynatıcı.apk
Resource
android-x64-arm64
Behavioral task
behavioral3
Sample
09586_Video_Oynatıcı.apk
Resource
android-x64
General
-
Target
09586_Video_Oynatıcı.apk
-
Size
2.6MB
-
MD5
2a6df4abb0cfc7ab9fa51125b00c6757
-
SHA1
2f418f5a0e63c5416708c3aa698e15e2b8671c0c
-
SHA256
f6dbfb0b634288955450f2d779f0d17f9cfa0bf9499341909245156ccc9a1adc
-
SHA512
c6accc51e38b2ed765d60eb439c66a48fab8be706bb04d34380154f90bf30b6bc6ed05a04566ed8e2a1557318cea5ca594fc2cc78aafc92d6621dad3cda0a1a1
Malware Config
Extracted
hydra
http://greysondowling458.xyz
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.jcojmdvo.eqdlwqnioc pid process /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zip 3838 com.jcojmdvo.eqdlwqn -
Uses reflection 3 IoCs
Processes:
com.jcojmdvo.eqdlwqndescription pid process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3838 com.jcojmdvo.eqdlwqn Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3838 com.jcojmdvo.eqdlwqn Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3838 com.jcojmdvo.eqdlwqn
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/MultiDex.lockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zipMD5
588e83008876f2f285eab4828a24f317
SHA139fcff812e3940acb6a90d7e5c337dfa71b3f223
SHA25691c854f41706550af73c3fe1279eb0b6a971cec172109b55f30dfe71ce451479
SHA512d34317ece6dd5242002309db8bc416a40d7bdf1faba71548cbb622b68394794e6eb476bb02a33a65f6501e251e31bacec05253a96ec4152d031bffa2aab5c44a
-
/data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/tmp-base.apk.classes4400047099036418104.zipMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/multidex.version.xmlMD5
3ddbb84ae3874c24aa6e921453f4d5b4
SHA11f96b5ee16921827da961cec79820f3568471ae8
SHA256abf7c6f9032613879ea94968efb705aead786b38f72d77f87eeb93f9d6780850
SHA512b08a514bea3f014bbdd4dcc7045f37ff400907d90322f83614fbf4398fd845f8f6ef7eefb82f6ef3f1afc8bdfbaf96641bfadb58af2c2910bb6542f46141c7d2
-
/data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/pref_name_setting.xmlMD5
2f9b70dce7e4a9953825bbe30153ca85
SHA1150fdbd811f13c8c67756d535b4e36a9f80711f8
SHA256a8468692a43f36b7663092933df9122702354e0e6e874625deb6175abc26d825
SHA5124bba19cbfd64a506ff9c1574773241a3cbb3a6893eab34667efb1885123ce80c8b3f398fe0bc30c7c1a4cbc2a35e5aaeec419b8f32c6b9ee2db2622ce546d73d
-
/data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/pref_name_setting.xmlMD5
03a5d226a9df6243b2168e43c7d1ccbe
SHA1a8625a00f767b6db101e53d1d833f7175c901c73
SHA256dd98d07866791074da9fd9b16a09ef751837f94d651e9b5bf93c7d0dc2053013
SHA5123492a8012ed2765c7fb011fef7cb7703ecba2e9826aedfa3754d6d378728467b8d561391e4508472f92c6cf196cb2a9f11626a1f93a7293ad581b339dcc1c3b5
-
/data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/prefs30.xmlMD5
12d6ab1d27552f5788e1667ec0eb1360
SHA1f0c1a775a55b7bb45fe65579b526cf4360c0c4d6
SHA25652e178aa40fd1c71b3a4e8fdfb73fba744ac754430d94697f4d2aaa6823c0d18
SHA51287eb0dba3f5fbb8801a5b8a07849c8634698d64333f77d548f4596221d2f3d7cba7288ebb0fe0b7f9357add2636b07c6e9cd24aa887dd6cce6d22a1b7e2d3d32