Analysis
-
max time kernel
898243s -
max time network
152s -
platform
android_x64 -
resource
android-x64 -
submitted
30-09-2021 07:07
Static task
static1
Behavioral task
behavioral1
Sample
75041_Video_Oynatıcı.apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
75041_Video_Oynatıcı.apk
-
Size
3.8MB
-
MD5
b1992b19bac66f610720c60f86b1fc88
-
SHA1
fd1ecd92102553e872b1ffbf50cd1aa2ae04b652
-
SHA256
625695ea0c246de98e12e2f5f8a5f05d23f03ffb2267a9f8c43429e1eac97499
-
SHA512
e51a5e21b17d13599c9ebff6b98020abdbe68c15212ad367e7b1184099223b12448e30adbebd106df3df5aca2ab5ea831ef60856700b137811ac6eb14a49f7e2
Score
10/10
Malware Config
Extracted
Family
hydra
C2
http://lolamaefarmer5823.online
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.couqghms.mrfqrne/bnjaptbngn/ffitfjiftUvwdz8/base.apk.gfftphv1.kck 3667 com.couqghms.mrfqrne -
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
description ioc Process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName com.couqghms.mrfqrne -
Uses reflection 3 IoCs
description pid Process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3667 com.couqghms.mrfqrne Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3667 com.couqghms.mrfqrne Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3667 com.couqghms.mrfqrne