Analysis
-
max time kernel
1265755s -
max time network
198s -
platform
android_x64 -
resource
android-x64 -
submitted
15/08/2021, 20:09
Static task
static1
Behavioral task
behavioral1
Sample
91648_Video_Oynatıcı.apk
Resource
android-x86-arm
Behavioral task
behavioral2
Sample
91648_Video_Oynatıcı.apk
Resource
android-x64-arm64
Behavioral task
behavioral3
Sample
91648_Video_Oynatıcı.apk
Resource
android-x64
General
-
Target
91648_Video_Oynatıcı.apk
-
Size
3.0MB
-
MD5
f754fdb148454e2aaeac021374e7cd03
-
SHA1
5eaaca3b46cc0b7027c8cf5cb30be9d270315da3
-
SHA256
1101d16bdbd021d03cec94ac05abce0498ea5766923ac060caf6fa5d95ba98ca
-
SHA512
ad8579d62005d129e5428e080f75799ab82ebe0e191648a2607c04d4649e5b48770a29f49611a2745e9b24419e1d3c34de7cb381976bdc9593014256c19a3412
Malware Config
Extracted
hydra
http://danylmassey574.xyz
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.mnjgllsx.thwzxxs/code_cache/secondary-dexes/base.apk.classes1.zip 3652 com.mnjgllsx.thwzxxs -
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.mnjgllsx.thwzxxs -
Uses reflection 3 IoCs
description pid Process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3652 com.mnjgllsx.thwzxxs Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3652 com.mnjgllsx.thwzxxs Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3652 com.mnjgllsx.thwzxxs