Analysis
-
max time kernel
3001053s -
max time network
155s -
platform
android_x64 -
resource
android-x64 -
submitted
04/09/2021, 22:09
Static task
static1
Behavioral task
behavioral1
Sample
61524_Video_Oynatıcı (1).apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
61524_Video_Oynatıcı (1).apk
-
Size
2.8MB
-
MD5
444f7fa5b7195e5ab4bd08f2674b0d94
-
SHA1
2b568ef48ee55b58411f84707f10078e78dee4c2
-
SHA256
384b2f4bbd5da1e58d66339557c8af0ba67f42059653da081b0c69e1cc1df4c4
-
SHA512
059152d4fe1389625c4cf657d606ade770b503fa100fd4117ca1068c382d847a22a94f0fc27d2d7446f0029840d853bffb29a9ed325a4f83b56465fdb7c25c08
Score
10/10
Malware Config
Extracted
Family
hydra
C2
http://kerrihuffman1237.online
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.coekfvmv.emkmads/code_cache/secondary-dexes/base.apk.classes1.zip 3619 com.coekfvmv.emkmads -
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
description ioc Process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName com.coekfvmv.emkmads -
Uses reflection 3 IoCs
description pid Process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3619 com.coekfvmv.emkmads Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3619 com.coekfvmv.emkmads Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3619 com.coekfvmv.emkmads