Analysis
- max time kernel
1172802s - max time network
137s - platform
android_x86 - resource
android-x86-arm - submitted
01/03/2022, 14:32
General
- Target bawag.apk
- Size 6.2MB
- Sample220301-rwallsbhdq
- SHA256 a6d27ba039ac9cb0d5a6a3cffca2002feb9ecb8cfed54ce5c0a768064084d43d
Score
10/10
Malware Config
Signatures
- Hydra
Android banker and info stealer.
- Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Reads information about phone network operator.
Processes
-
com.ombththz.ufqsuqx1⤵
- Loads dropped Dex/Jar
-
com.ombththz.ufqsuqx2⤵
-
-
/system/bin/dex2oat2⤵
- Loads dropped Dex/Jar
-
-
com.ombththz.ufqsuqx2⤵
-
-
toolbox2⤵
-
-
com.ombththz.ufqsuqx2⤵
-
-
/system/bin/sh2⤵
-
-
/system/bin/ndk_translation_program_runner_binfmt_misc2⤵
-
-
com.ombththz.ufqsuqx2⤵
-
-
/system/bin/sh2⤵
-
-
/system/bin/ndk_translation_program_runner_binfmt_misc2⤵
-
/system/bin/ndk_translation_program_runner_binfmt_misc3⤵
-
-
-
/system/bin/ndk_translation_program_runner_binfmt_misc1⤵