Analysis

  • max time kernel
    1553257s
  • max time network
    103s
  • platform
    android_x64
  • resource
    android-x64
  • submitted
    26-11-2021 14:09

General

  • Target

    bawag.apk

  • Size

    8.2MB

  • MD5

    2cc9b0f73c834830b99ef2a9e0c3da27

  • SHA1

    5d0b20afb0f45c5acbdcfee49b41f83cee3fca83

  • SHA256

    d5a63c4ace387cff8d641ad9aeedf9e406684b0f3bdcfc79e97de80eef177bee

  • SHA512

    6d7eb370926eb81a7d63c43c3572028f3e7e66c86982c5272a340b00f9c29800892d0ffa4f5d27eb61e6df81bf56ca1b2dc8fece28594bbca1c05739eab004ab

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.feel.rabbit
    1⤵
    • Loads dropped Dex/Jar
    PID:3679

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.feel.rabbit/app_DynamicOptDex/lrIXlp.json

    MD5

    a4c6f6e4a97bf6313577c8b1af109bd4

    SHA1

    5373824d516523234b5ad38b003c91c8a43b7d66

    SHA256

    6c5243c09a58e9cafa346e540816b4c3a609226e7c6558131f3f863249acbd3e

    SHA512

    8a225beeaf8ffe301fddd77dc88f976eaaa80c57e34a0dbc4ab83caa324dd7b94f6c853cd8a47d987a2919c73982077f61580521a9d285d4b1e155e33353535d

  • /data/user/0/com.feel.rabbit/app_DynamicOptDex/lrIXlp.json

    MD5

    a4c6f6e4a97bf6313577c8b1af109bd4

    SHA1

    5373824d516523234b5ad38b003c91c8a43b7d66

    SHA256

    6c5243c09a58e9cafa346e540816b4c3a609226e7c6558131f3f863249acbd3e

    SHA512

    8a225beeaf8ffe301fddd77dc88f976eaaa80c57e34a0dbc4ab83caa324dd7b94f6c853cd8a47d987a2919c73982077f61580521a9d285d4b1e155e33353535d