Analysis
-
max time kernel
3153469s -
max time network
152s -
platform
android_x64 -
resource
android-x64 -
submitted
06-09-2021 16:32
Static task
static1
Behavioral task
behavioral1
Sample
10482_Video_Oynatıcı.apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
10482_Video_Oynatıcı.apk
-
Size
2.8MB
-
MD5
ffce59f44fe794ceb53c215d9c8bd17f
-
SHA1
0782156341937276c0883946f91187e2e2c34c86
-
SHA256
a0de1add961f3a9bf6e2e391489fdbac244932352421055f23f34c93c82b8856
-
SHA512
8558f92dd5a7238c87277db05dd537b8ecb26a314dbc0483478bf1cf0a251a2d4cb044ee4347d766293d273ca89a05f6d7aa9bbfe5567aace682b3a0640b71b3
Score
10/10
Malware Config
Extracted
Family
hydra
C2
http://kerrihuffman1237.online
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.njzbfugl.lzzhmzl/code_cache/secondary-dexes/base.apk.classes1.zip 3644 com.njzbfugl.lzzhmzl -
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
description ioc Process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName com.njzbfugl.lzzhmzl -
Uses reflection 3 IoCs
description pid Process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3644 com.njzbfugl.lzzhmzl Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3644 com.njzbfugl.lzzhmzl Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3644 com.njzbfugl.lzzhmzl