Analysis
-
max time kernel
533662s -
max time network
82s -
platform
android_x64 -
resource
android-x64-arm64 -
submitted
07-08-2021 08:49
Static task
static1
Behavioral task
behavioral1
Sample
36509_Video_Oynatıcı.apk
Resource
android-x86-arm
Behavioral task
behavioral2
Sample
36509_Video_Oynatıcı.apk
Resource
android-x64-arm64
Behavioral task
behavioral3
Sample
36509_Video_Oynatıcı.apk
Resource
android-x64
General
-
Target
36509_Video_Oynatıcı.apk
-
Size
3.1MB
-
MD5
5f9eff5c3af6f72e93937ba09f40b5d7
-
SHA1
bdc23081a728a2557ceedcabf787e9847e6df159
-
SHA256
ccebc2265cae07b7798d8bd7b194ae999f1e9f4b2652d3d220b873c23610f0c7
-
SHA512
8d54d2d0297c617e0cab94b1feae1fc4e54250fd9fc66e8d5645a8a63cc000b5837dc0c6632559498bf054bc065bb3fa159027172f3711c4942c6e9a70916692
Malware Config
Extracted
hydra
http://courteneyguerrero584.xyz
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.jrrnwddn.bsjpjltioc pid process /data/user/0/com.jrrnwddn.bsjpjlt/code_cache/secondary-dexes/base.apk.classes1.zip 4316 com.jrrnwddn.bsjpjlt -
Uses reflection 3 IoCs
Processes:
com.jrrnwddn.bsjpjltdescription pid process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 4316 com.jrrnwddn.bsjpjlt Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4316 com.jrrnwddn.bsjpjlt Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4316 com.jrrnwddn.bsjpjlt
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
c8cead98bd56feb8919c2750f502d468
SHA1c0f8465438d314c526c2d3e1942ec61853757f1e
SHA256d375d394a8ebc0409a5ed6fa121a0665b9c58c834959377aff2376e6b991f2e0
SHA5124154459041e4d5fabbee7ac5c620f87a5bd1b59ab84da28da628ae111d8055b8d1a7eb9e67496338d143232a70482fc3b4e566a373eeabcb0517d172e97bdb4b
-
/data/user/0/com.jrrnwddn.bsjpjlt/code_cache/secondary-dexes/tmp-base.apk.classes204422766595908493.zip
MD5d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
520dadc8e573f868fa7f65adb48da229
SHA19a1bf273af8311c71a10367e8348ab44c69a63e1
SHA2569bfe33d815ba44b58631327df14ff6b12a2c8bde480644881f2f6c1d582dfc4d
SHA5122235cbe4382c147ee5853b32175d3eabb51df633eed18ff6256898f1bf3954592d375545af2c06a34ffe9bfb03e5d0e6e0eb81364ad86fc8052c587b48ad735c
-
MD5
65661ea8b5a3359d1b5b3acfcdde8ac2
SHA142e4b87def1beb0d6e0df5e0654f520772eaf845
SHA256a6e06c856dee3dd45a3b2b372e6bd6a3f05f389cdd175aa2ab9470ac8c78ff67
SHA512d568aa4b46c25ca158313dd51e40fbe53f4d80c8e661e521ba176fd8b250d4f9b07c93d4ccacc3951155a0afefc7c4be689080342cf45880e19603b55140d518
-
MD5
5b3424c4da68158980265365ee700a54
SHA1400a39f87e665141beae00de9a9dc220f87ec3b8
SHA2567cf3877a0eb56abd220a8ea43c9b8b3b33f7e5dfd6422dbf1c78e48233b5f287
SHA512562dcbd9075b91eb7a10b1bcbbc1eaf27f3dc1065d5a9c400ed78752e6ac9b8e1b2b078ebd903c008d68eaf76e223c7c849e1b6287ffe4998ac6f47f248d61c4
-
MD5
1c6b6a6a91f2ccf7ac553f9a439ad69e
SHA1270b45bc1c3255f95fecf8bfa85f7dbfc8fb5748
SHA256a7958ee3107cac53056bac67328f317cf9e3aaf4533e1072f0c4f0334ebbffa6
SHA5128a61fcab1bc82977f72af693d4a749ad41df81a9a9c6eaafee0f4ffd36a34f069a259c6b20046a8bce58a6eab526df122cb82e8d093be73cf5ff9d41e489bf8e