Analysis

  • max time kernel
    796146s
  • platform
    android_x86
  • resource
    android-x86-arm
  • submitted
    10-08-2021 09:43

General

  • Target

    90635_Video_Oynatıcı.apk

  • Size

    3.1MB

  • MD5

    e64e9fc94ff0b95e5c0cf2b38be94502

  • SHA1

    7c9861d9fb7b00ea43113d7a36902b2c2525a1ee

  • SHA256

    d97aab6e351401596e170f056c3833bfd709cf44a2db97739a9129910fe2ece1

  • SHA512

    59bafd293766ac2aa60d06fe375eb4e4855dbb4d88577b83995fe0970960dadc9bf442bcba96d2bca8f757d6035e9c90ee45f1a66f934d8b13fe710da3ead220

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Uses reflection 1 IoCs

Processes

  • com.yzojnxnf.buzdnua
    1⤵
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Uses reflection
    PID:5066
    • com.yzojnxnf.buzdnua
      2⤵
        PID:5093
      • /system/bin/dex2oat
        2⤵
        • Loads dropped Dex/Jar
        PID:5093

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/user/0/com.yzojnxnf.buzdnua/code_cache/secondary-dexes/MultiDex.lock
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.yzojnxnf.buzdnua/code_cache/secondary-dexes/base.apk.classes1.zip
      MD5

      e6f382e34842e02a8777077c74ed0dea

      SHA1

      60767bc7c91475c1a63ba074bc8549bb3aabac97

      SHA256

      ae977aa24838f08096f8b0c4840fe2eac8deefe3b0ba7fdef7740a449bbd3b50

      SHA512

      3eadfcd05f8b2d60293243e7ab1cc5d148fd00ef3e2efae0e121fc63b78b382967a2e625774e7a7ab7b3808cc2f71d3a66d84f7e1994627b0ac5368c59a31c8a

    • /data/user/0/com.yzojnxnf.buzdnua/code_cache/secondary-dexes/base.apk.classes1.zip
      MD5

      32402d48b275e41cc5442589a81990e1

      SHA1

      f76850317f3b3c84b57e91703f59b3f7d697577e

      SHA256

      9b69e3577180577a26eca85b5d81154ed7533376363d0e43328db7d081a275ee

      SHA512

      a5e1cad53f86c144ec123112b7dd0428d5446e85e4e20ac1260dbfba3132b1e1bf49f4ffbeffc94a1d561ab0def8f32e42d493a1cf49b370a14a76e6523ad1fc

    • /data/user/0/com.yzojnxnf.buzdnua/code_cache/secondary-dexes/base.apk.classes1.zip.x86.flock
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.yzojnxnf.buzdnua/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.yzojnxnf.buzdnua/code_cache/secondary-dexes/oat/x86/base.apk.classes1.vdex
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.yzojnxnf.buzdnua/code_cache/secondary-dexes/tmp-base.apk.classes9041591728232973429.zip
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.yzojnxnf.buzdnua/shared_prefs/multidex.version.xml
      MD5

      103e7bfe32a1d742b807af2fa9c23c38

      SHA1

      31f09d4e1a5b201b83b0d24d6e80c3f7c7bc5afd

      SHA256

      07b767e76c42f0510a8274ed58e413244b6c294566767ff42f779356e08653db

      SHA512

      293268ef2c003f3446460b4ed649d9d1b8b75cda76e696e38df9081378f7d11fb6dd39059ebd033b81bbeeb72e9b7cd62ac1f023a3dcd8409c0864f7aed04f77

    • /data/user/0/com.yzojnxnf.buzdnua/shared_prefs/pref_name_setting.xml
      MD5

      95ba1fe8212ac25b7f93d70286bd2067

      SHA1

      7f9ace4b3cf417ee15fb85e8fc4f739dcdec8ece

      SHA256

      c76e10911e6789ba8092782df40e03500064041f12fc947aee87fc7b6a07c223

      SHA512

      8a6b024c14dcfd89b585cb605db8ece3787bdb4349f2fec6bed2a3f4addcc2b7dc729539004452ddabecd762f98d852edf576cf33f63964897b5203e132b779b

    • /data/user/0/com.yzojnxnf.buzdnua/shared_prefs/pref_name_setting.xml
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.yzojnxnf.buzdnua/shared_prefs/pref_name_setting.xml
      MD5

      0d5b7de93a6acf9c748d6dbe7823ef5c

      SHA1

      6334c3530922a4444959679770e9491407e76483

      SHA256

      675bae044f748038651c046db2a9d0ef54ef758f0e5f94c3690e40843fb1daba

      SHA512

      f8851efb9618265860281a92ca64200ffdec68110c3a3e77913e1f6aaee9d6fc8e8ec8d234a2cc430973710fe86bd80252a62b5326364d81ad932d3a65440506

    • /data/user/0/com.yzojnxnf.buzdnua/shared_prefs/prefs30.xml
      MD5

      1c6b6a6a91f2ccf7ac553f9a439ad69e

      SHA1

      270b45bc1c3255f95fecf8bfa85f7dbfc8fb5748

      SHA256

      a7958ee3107cac53056bac67328f317cf9e3aaf4533e1072f0c4f0334ebbffa6

      SHA512

      8a61fcab1bc82977f72af693d4a749ad41df81a9a9c6eaafee0f4ffd36a34f069a259c6b20046a8bce58a6eab526df122cb82e8d093be73cf5ff9d41e489bf8e