Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3000891s -
max time network
156s -
platform
android_x64 -
resource
android-x64 -
submitted
04/09/2021, 22:09
Static task
static1
Behavioral task
behavioral1
Sample
04852_Video_Oynatıcı.apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
04852_Video_Oynatıcı.apk
-
Size
2.8MB
-
MD5
181c5b246238ce6dd468dde332a33212
-
SHA1
efda29b74d3217a71574998741fa6705fe94f83e
-
SHA256
7816da4e76ac01e372b8ffa022e13457b6202f3db0984a6235a894eae4f72bd4
-
SHA512
edc2436f0793c4db477d079f82b4df142ce59a3a959efea6fe1614c118c182fb8896508ad17932a04059bd1647376017c19ff3869026a2df9c8d4af334659ad7
Score
10/10
Malware Config
Extracted
Family
hydra
C2
http://kerrihuffman1237.online
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.jvxyxzzu.ybkrznc/code_cache/secondary-dexes/base.apk.classes1.zip 3648 com.jvxyxzzu.ybkrznc -
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
description ioc Process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName com.jvxyxzzu.ybkrznc -
Uses reflection 3 IoCs
description pid Process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3648 com.jvxyxzzu.ybkrznc Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3648 com.jvxyxzzu.ybkrznc Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3648 com.jvxyxzzu.ybkrznc