Analysis

  • max time kernel
    1945871s
  • max time network
    192s
  • platform
    android_x64
  • resource
    android-x64-arm64
  • submitted
    01-12-2021 03:13

General

  • Target

    FlashPlayerV4.7.apk

  • Size

    7.9MB

  • MD5

    576729c3a72dbc45951e6aa808fc7536

  • SHA1

    6f527d1b531389fb5221b8469969e2f8541e32cb

  • SHA256

    f82ce4168051c18028bd94ae29eafb201928f9fa90856d8ed12f36acb891d439

  • SHA512

    f8b58668f52cf3a6e64ba765d328f127297f708cedd93a14869fa1eddec98433f0a33e071b073798c4253ccce6613e993f77e354bbc9ec0f081bf53afb343134

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.risk.penalty
    1⤵
    • Loads dropped Dex/Jar
    PID:4093

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.risk.penalty/app_DynamicOptDex/MXX.json

    MD5

    6eadfd85db69a9bb3ca2a131ba0f3706

    SHA1

    78ef4c32a8d2e93683bc9be94fbd0757d1b73c98

    SHA256

    77cabf54d65109e5f27ba0ef45bc1a23494005177199b0c1ff504f1032e0ee76

    SHA512

    7381558857703dddb6815ac89458bb7b1ae296d4ce1881f9468f05ebb1e3ada00dab98aa916e077216cc001abe83928fe0d75644b373c0a683126c7709eb4f8c

  • /data/user/0/com.risk.penalty/app_DynamicOptDex/MXX.json

    MD5

    6eadfd85db69a9bb3ca2a131ba0f3706

    SHA1

    78ef4c32a8d2e93683bc9be94fbd0757d1b73c98

    SHA256

    77cabf54d65109e5f27ba0ef45bc1a23494005177199b0c1ff504f1032e0ee76

    SHA512

    7381558857703dddb6815ac89458bb7b1ae296d4ce1881f9468f05ebb1e3ada00dab98aa916e077216cc001abe83928fe0d75644b373c0a683126c7709eb4f8c