Analysis

  • max time kernel
    3265840s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64
  • submitted
    16-12-2021 09:42

General

  • Target

    f8d6d8bc3a653b709388788c38f1fdccb90cca3d0614bc0b25fbe00f6149612e.apk

  • Size

    6.9MB

  • MD5

    16c009e5049f1bf213e9e2773634bd1f

  • SHA1

    7b04fae79b75e7d10bec84b3df20fac321d19bf3

  • SHA256

    f8d6d8bc3a653b709388788c38f1fdccb90cca3d0614bc0b25fbe00f6149612e

  • SHA512

    955589f566090512361070bc2bd80140aba4db77e9fc441e9f11afe7b22b79a2c4ebc40c8e57aae7dd8b3919416e22c54a39a7c059e4a2dae735d299b86b4550

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

Processes

  • com.illegal.faint
    1⤵
    • Loads dropped Dex/Jar
    PID:3665
    • com.illegal.faint
      2⤵
        PID:3816
      • toolbox
        2⤵
          PID:3816
        • com.illegal.faint
          2⤵
            PID:3851
          • /system/bin/sh
            2⤵
              PID:3851

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/user/0/com.illegal.faint/app_DynamicOptDex/nIJUe.json

            MD5

            c6841ea1d335aefb0dcf4370d2199c5e

            SHA1

            a440bed9d918a6e2f732a5ef677ad96d139357da

            SHA256

            a9c2a738d10ddefea66a07db3457ef066314e249cebb967f8ebbd4d76d79131b

            SHA512

            726c29300a789bec5448b3fd74764a58dbc27fa4546ab951a87a6ad5b21af3bd0ce92cdb7368507122c09802f31a8f674f0c42ddf5d1aa31809703ab620d0ff2

          • /data/user/0/com.illegal.faint/app_DynamicOptDex/nIJUe.json

            MD5

            c6841ea1d335aefb0dcf4370d2199c5e

            SHA1

            a440bed9d918a6e2f732a5ef677ad96d139357da

            SHA256

            a9c2a738d10ddefea66a07db3457ef066314e249cebb967f8ebbd4d76d79131b

            SHA512

            726c29300a789bec5448b3fd74764a58dbc27fa4546ab951a87a6ad5b21af3bd0ce92cdb7368507122c09802f31a8f674f0c42ddf5d1aa31809703ab620d0ff2