Overview

overview

10

Static

static

7

29DBB4D3B1...SK.apk

android_x86

10

29DBB4D3B1...SK.apk

android_x64

10

29DBB4D3B1...SK.apk

android_x64

10

Analysis

  • max time kernel
    3132040s
  • max time network
    183s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    24-03-2022 06:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    29DBB4D3B12EF397538F6BFC04005AF4-BAWAG_PSK.apk

  • Size

    3.9MB

  • MD5

    29dbb4d3b12ef397538f6bfc04005af4

  • SHA1

    a66e0803bcd3de355c4a0bbfc8cbe37141564b89

  • SHA256

    a3b826de0c445f0924c50939494a26b0d99ef3ccac80faacca98673625656278

  • SHA512

    5abfd4248dc26e17b751158fa8099db65f13eb96a1194d6d2d73a0ff8ee518b346d0ccd31eca8ae59822f950b22ab0861077fcbac067c864ed812fc19ae8d544

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra Payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs

Processes

  • com.almost.sign
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:7092
    • toolbox ps
      2⤵
        PID:7250
      • /system/bin/sh -c /data/user/0/com.almost.sign/files/tor_source/tor.so DataDirectory /data/user/0/com.almost.sign/app_data --defaults-torrc /data/user/0/com.almost.sign/files/tor_source/torrc -f /data/user/0/com.almost.sign/files/tor_source/torrc.custom --verify-config
        2⤵
          PID:7276

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads