Overview

overview

10

Static

static

7

bawag.apk

android_x86

10

bawag.apk

android_x64

10

bawag.apk

android_x64

10

Analysis

  • max time kernel
    4255292s
  • max time network
    145s
  • platform
    android_x86
  • resource
    android-x86-arm
  • submitted
    15-02-2022 13:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bawag.apk

  • Size

    6.2MB

  • MD5

    4212125ef94304e3dd9659186204fc5c

  • SHA1

    c807313be5dd0fc754ba913d1b7e6a40bd8a663f

  • SHA256

    507f55a17a03490978c09690fc2f11a900b52ff7bc4a73f8af9ea9c586b83d75

  • SHA512

    709c3d2975b5c1b4740bd80e4b9a8a10d97e584b9cfe75185b5d4fb2f78fa2868bafbc328a2234786226233a54826eff25f929d2dc7e27d70300c7ce50d8f21d

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.nfrwxqmj.tixwgea
    1⤵
    • Loads dropped Dex/Jar
    PID:5085
    • com.nfrwxqmj.tixwgea
      2⤵
        PID:5174
      • /system/bin/dex2oat
        2⤵
        • Loads dropped Dex/Jar
        PID:5174
      • com.nfrwxqmj.tixwgea
        2⤵
          PID:5494
        • toolbox
          2⤵
            PID:5494
          • com.nfrwxqmj.tixwgea
            2⤵
              PID:5674
            • /system/bin/sh
              2⤵
                PID:5674
              • /system/bin/ndk_translation_program_runner_binfmt_misc
                2⤵
                  PID:5674
                • com.nfrwxqmj.tixwgea
                  2⤵
                    PID:5734
                  • /system/bin/sh
                    2⤵
                      PID:5734
                    • /system/bin/ndk_translation_program_runner_binfmt_misc
                      2⤵
                        PID:5734
                        • /system/bin/ndk_translation_program_runner_binfmt_misc
                          3⤵
                            PID:5764
                      • /system/bin/ndk_translation_program_runner_binfmt_misc
                        1⤵
                          PID:5774

                        Network

                        MITRE ATT&CK Matrix

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • /data/user/0/com.nfrwxqmj.tixwgea/Gg9Gug9G6G/ItUfyqfo8gwfg8T/base.apk.hk8iIhG1.qqj
                          MD5

                          26aab411eb6c5a1e251166efd4c2721a

                          SHA1

                          2c0526a43d1f9a92989f61a6774cdb732e1c5de9

                          SHA256

                          c219b5987ddef66ee39c5f8da4efb958bd9566f5a8c52a5fe699caffc2cae238

                          SHA512

                          f39848d26e2c221574e9861c9c3af4885ac7c3f7e4f02cfa483932bb2cef78ad87aa72ad33e2f59660ef95167091f0d629d092c9bc6ca5fc564a21fc159a2693

                          Download Submit
                        • /data/user/0/com.nfrwxqmj.tixwgea/Gg9Gug9G6G/ItUfyqfo8gwfg8T/base.apk.hk8iIhG1.qqj
                          MD5

                          f13eed9e4b3440502301c86fcf2d2512

                          SHA1

                          b72aa5c25142e5ddd83e7c602427fce61be9981f

                          SHA256

                          c5a9d457cf1f5aead644a6ba26dcddf830c2ecc62007e637c93ff1aa00cf93c3

                          SHA512

                          730444c8ab15906967f730f2f57c68738bf6ed714d8cee83e38f49722474e7be8923a16c34ba8d1a813d4c632a7861d6d58019b71c9f7672b2ce90841f7905a6

                          Download Submit