Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4249636s -
max time network
160s -
platform
android_x86 -
resource
android-x86-arm -
submitted
15/02/2022, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
b9dd9650cb0591a0c15e44da102dc65449aca415822c102c26fb7a0321803374.apk
Resource
android-x86-arm
Behavioral task
behavioral2
Sample
b9dd9650cb0591a0c15e44da102dc65449aca415822c102c26fb7a0321803374.apk
Resource
android-x64
Behavioral task
behavioral3
Sample
b9dd9650cb0591a0c15e44da102dc65449aca415822c102c26fb7a0321803374.apk
Resource
android-x64-arm64
General
-
Target
b9dd9650cb0591a0c15e44da102dc65449aca415822c102c26fb7a0321803374.apk
-
Size
6.0MB
-
MD5
f9bc80b984b9ca2012dab7b557d25f25
-
SHA1
e13fdc7d91e9b890cfe5940a7245344a01a2179e
-
SHA256
b9dd9650cb0591a0c15e44da102dc65449aca415822c102c26fb7a0321803374
-
SHA512
5090e552ce2efb5bbae29a05b00d5ff76bf61f5484e327df686f49ac99d23955bc6d496ebe23326c218e6cccee745e970a899596f60c90c57f1a6f2e2323cd0a
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.ibpizpaa.bdtddqo/ghfh8GUUgG/wtgyqfjGfqhpttG/base.apk.q8juGj71.wqi 5187 /system/bin/dex2oat /data/user/0/com.ibpizpaa.bdtddqo/ghfh8GUUgG/wtgyqfjGfqhpttG/base.apk.q8juGj71.wqi 5070 com.ibpizpaa.bdtddqo -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 73 ip-api.com -
Reads information about phone network operator.
Processes
-
com.ibpizpaa.bdtddqo1⤵
- Loads dropped Dex/Jar
PID:5070 -
com.ibpizpaa.bdtddqo2⤵PID:5187
-
-
/system/bin/dex2oat2⤵
- Loads dropped Dex/Jar
PID:5187
-
-
com.ibpizpaa.bdtddqo2⤵PID:5599
-
-
toolbox2⤵PID:5599
-
-
com.ibpizpaa.bdtddqo2⤵PID:5663
-
-
/system/bin/sh2⤵PID:5663
-
-
/system/bin/ndk_translation_program_runner_binfmt_misc2⤵PID:5663
-
-
com.ibpizpaa.bdtddqo2⤵PID:5698
-
-
/system/bin/sh2⤵PID:5698
-
-
/system/bin/ndk_translation_program_runner_binfmt_misc2⤵PID:5698
-
/system/bin/ndk_translation_program_runner_binfmt_misc3⤵PID:5722
-
-
-
/system/bin/ndk_translation_program_runner_binfmt_misc1⤵PID:5732