Analysis
-
max time kernel
3000896s -
max time network
156s -
platform
android_x64 -
resource
android-x64 -
submitted
04-09-2021 22:09
Static task
static1
Behavioral task
behavioral1
Sample
98173_Video_Oynatıcı.apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
98173_Video_Oynatıcı.apk
-
Size
2.8MB
-
MD5
80d0ea203dd51b7689349cee6e0d2e88
-
SHA1
8f160183896f65aa9b1524382279448f1010d021
-
SHA256
6253cac300eabed08691f1dd70f93ce86513ce98d2a577007efa0cb3a2560aa5
-
SHA512
b2588300626f774d150af1a0e4ed3cd58212b23e6b75e5e5347a9b2d766d14810d00b27f26e1d85c5e1e28b01d226dfd20c2d9a817b37b879f10bb38e25307ea
Score
10/10
Malware Config
Extracted
Family
hydra
C2
http://kerrihuffman1237.online
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dhmqdmkq.ibjtwkn/code_cache/secondary-dexes/base.apk.classes1.zip 3705 com.dhmqdmkq.ibjtwkn -
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
description ioc Process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName com.dhmqdmkq.ibjtwkn -
Uses reflection 3 IoCs
description pid Process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3705 com.dhmqdmkq.ibjtwkn Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3705 com.dhmqdmkq.ibjtwkn Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3705 com.dhmqdmkq.ibjtwkn