Overview

overview

10

Static

static

7

bawag.apk

android_x86

10

bawag.apk

android_x64

10

bawag.apk

android_x64

10

Resubmissions

01-03-2022 14:32

220301-rwallsbhdq 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bawag.apk

  • Size

    6.2MB

  • Sample

    220301-rwallsbhdq

  • MD5

    e5445cda1bf1f82fc1fd4edb1317c41f

  • SHA1

    8b3d7122a94bb1694e1d3e33cbbd056e4350598b

  • SHA256

    a6d27ba039ac9cb0d5a6a3cffca2002feb9ecb8cfed54ce5c0a768064084d43d

  • SHA512

    84dcd079ac022faf2707c2cdb48bc656320307e0d03d58748de78a7fa73bfe8c071a491bdc4401e7b8d31e60024cae43c947307ffdc64d7c54e4f185076fe0bc

Score
10/10
hydraandroidbankerinfostealertrojan

Malware Config

Targets

    • Target

      bawag.apk

    • Size

      6.2MB

    • MD5

      e5445cda1bf1f82fc1fd4edb1317c41f

    • SHA1

      8b3d7122a94bb1694e1d3e33cbbd056e4350598b

    • SHA256

      a6d27ba039ac9cb0d5a6a3cffca2002feb9ecb8cfed54ce5c0a768064084d43d

    • SHA512

      84dcd079ac022faf2707c2cdb48bc656320307e0d03d58748de78a7fa73bfe8c071a491bdc4401e7b8d31e60024cae43c947307ffdc64d7c54e4f185076fe0bc

    Score
    10/10
    hydrabankerinfostealertrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Makes use of the framework's Accessibility service.

    • Checks Qemu related system properties.

      Checks for Android system properties related to Qemu for Emulator detection.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks