Analysis

  • max time kernel
    4255309s
  • max time network
    175s
  • platform
    android_x64
  • resource
    android-x64
  • submitted
    15-02-2022 13:44

General

  • Target

    bawag.apk

  • Size

    6.2MB

  • MD5

    4212125ef94304e3dd9659186204fc5c

  • SHA1

    c807313be5dd0fc754ba913d1b7e6a40bd8a663f

  • SHA256

    507f55a17a03490978c09690fc2f11a900b52ff7bc4a73f8af9ea9c586b83d75

  • SHA512

    709c3d2975b5c1b4740bd80e4b9a8a10d97e584b9cfe75185b5d4fb2f78fa2868bafbc328a2234786226233a54826eff25f929d2dc7e27d70300c7ce50d8f21d

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Checks Qemu related system properties. 1 IoCs

    Checks for Android system properties related to Qemu for Emulator detection.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

Processes

  • com.nfrwxqmj.tixwgea
    1⤵
    • Checks Qemu related system properties.
    • Loads dropped Dex/Jar
    PID:3850
    • com.nfrwxqmj.tixwgea
      2⤵
        PID:3930
      • toolbox
        2⤵
          PID:3930
        • com.nfrwxqmj.tixwgea
          2⤵
            PID:3984
          • /system/bin/sh
            2⤵
              PID:3984

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/user/0/com.nfrwxqmj.tixwgea/Gg9Gug9G6G/ItUfyqfo8gwfg8T/base.apk.hk8iIhG1.qqj
            MD5

            f13eed9e4b3440502301c86fcf2d2512

            SHA1

            b72aa5c25142e5ddd83e7c602427fce61be9981f

            SHA256

            c5a9d457cf1f5aead644a6ba26dcddf830c2ecc62007e637c93ff1aa00cf93c3

            SHA512

            730444c8ab15906967f730f2f57c68738bf6ed714d8cee83e38f49722474e7be8923a16c34ba8d1a813d4c632a7861d6d58019b71c9f7672b2ce90841f7905a6