Analysis
-
max time kernel
2684457s -
max time network
166s -
platform
android_x64 -
resource
android-x64-arm64 -
submitted
28-01-2022 09:23
Static task
static1
Behavioral task
behavioral1
Sample
c91b92a91a53ce01c53a32668e56606303500db705176639bea2bca067183c12.apk
Resource
android-x86-arm
Behavioral task
behavioral2
Sample
c91b92a91a53ce01c53a32668e56606303500db705176639bea2bca067183c12.apk
Resource
android-x64
Behavioral task
behavioral3
Sample
c91b92a91a53ce01c53a32668e56606303500db705176639bea2bca067183c12.apk
Resource
android-x64-arm64
General
-
Target
c91b92a91a53ce01c53a32668e56606303500db705176639bea2bca067183c12.apk
-
Size
1.7MB
-
MD5
0239855689bf096b0e08068f45af9c26
-
SHA1
fc6653fd378b8962d26e66d0865422f5c481b60f
-
SHA256
c91b92a91a53ce01c53a32668e56606303500db705176639bea2bca067183c12
-
SHA512
ef464af8a49e8832e61df87c40bed8dcc883525d2956c6ecb589b03263c710f718af3979dcb880fd60696c67a3fd1f04546fa7f7908ce463071c15068d031887
Malware Config
Extracted
hydra
http://louisadickens483.website
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra Payload 1 IoCs
resource yara_rule behavioral3/memory/6278-0.dex family_hydra -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.tower.surge/app_DynamicOptDex/cBeDXms.json 6278 com.tower.surge