Analysis

  • max time kernel
    831288s
  • max time network
    340s
  • platform
    android_x64
  • resource
    android-x64-arm64
  • submitted
    06-01-2022 22:39

General

  • Target

    FlashPlayerV4.1.apk

  • Size

    7.0MB

  • MD5

    3fa53e0680d71e72e8e680ee77d1c38c

  • SHA1

    7d0e1043784975da7d387260a48b08aa1cc759f6

  • SHA256

    f2cc192b3fa03b637c3c407724c5bb24b84fdb0b55a73b152a3d8be30a2d2692

  • SHA512

    bcbf4b059ba9e4411ebd8da69dc2c36a6d212a7f8e8953cc81f1865fb89301f45067ad812f38ea0cd7011e7c2e7bdcf4757002b747625c2c8faf809144b83fd1

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.code.desert
    1⤵
    • Loads dropped Dex/Jar
    PID:6243
    • com.code.desert
      2⤵
        PID:6517

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/user/0/com.code.desert/app_DynamicOptDex/omn.json

      MD5

      82e6204f46d8b34d884169db1c104748

      SHA1

      cccc5958ec0ea5fa49641165694f9adc8e23c0df

      SHA256

      e61adf0bbc03df9e30f8f87be2a97f1e339cdcbe8475f4f4ee1b379034a7c62f

      SHA512

      14097db6633aa6a428c3931270e6df64627920cfe3c48608bcd22310613d57de7eef170564cf0907337408ecbc06fda59b8ce2381ea322f9a43d5120eeac0ab5

    • /data/user/0/com.code.desert/app_DynamicOptDex/omn.json

      MD5

      82e6204f46d8b34d884169db1c104748

      SHA1

      cccc5958ec0ea5fa49641165694f9adc8e23c0df

      SHA256

      e61adf0bbc03df9e30f8f87be2a97f1e339cdcbe8475f4f4ee1b379034a7c62f

      SHA512

      14097db6633aa6a428c3931270e6df64627920cfe3c48608bcd22310613d57de7eef170564cf0907337408ecbc06fda59b8ce2381ea322f9a43d5120eeac0ab5