Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3000242s -
max time network
44s -
platform
android_x64 -
resource
android-x64-arm64 -
submitted
04/09/2021, 21:59
Static task
static1
Behavioral task
behavioral1
Sample
61524_Video_Oynatıcı.apk
Resource
android-x86-arm
Behavioral task
behavioral2
Sample
61524_Video_Oynatıcı.apk
Resource
android-x64-arm64
Behavioral task
behavioral3
Sample
61524_Video_Oynatıcı.apk
Resource
android-x64
General
-
Target
61524_Video_Oynatıcı.apk
-
Size
2.8MB
-
MD5
444f7fa5b7195e5ab4bd08f2674b0d94
-
SHA1
2b568ef48ee55b58411f84707f10078e78dee4c2
-
SHA256
384b2f4bbd5da1e58d66339557c8af0ba67f42059653da081b0c69e1cc1df4c4
-
SHA512
059152d4fe1389625c4cf657d606ade770b503fa100fd4117ca1068c382d847a22a94f0fc27d2d7446f0029840d853bffb29a9ed325a4f83b56465fdb7c25c08
Malware Config
Extracted
hydra
http://kerrihuffman1237.online
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.coekfvmv.emkmads/code_cache/secondary-dexes/base.apk.classes1.zip 4169 com.coekfvmv.emkmads -
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
description ioc Process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName com.coekfvmv.emkmads -
Uses reflection 3 IoCs
description pid Process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 4169 com.coekfvmv.emkmads Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4169 com.coekfvmv.emkmads Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4169 com.coekfvmv.emkmads