Analysis

  • max time kernel
    3575397s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    29-03-2022 09:54

General

  • Target

    coba.apk

  • Size

    3.9MB

  • MD5

    cc75c64449276f37f147f7c8f5589e2c

  • SHA1

    d9e3d4a4f84ebb8c544e37ad470ccbf51f358007

  • SHA256

    5d6268d44f132574165ca78264744754186028c289fa37afeaf510fd0a0047f0

  • SHA512

    a2a209f7923d8bde635202e1b0c7e5dca91a18d8a6b2a53f0ea573150065c1a64c0bbfd65025bbe5e68bcc16b211ed8f54fad2105a2a462d7bcab619e9d377c0

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

Processes

  • com.magnet.grain
    1⤵
    • Loads dropped Dex/Jar
    PID:6221

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.magnet.grain/app_DynamicOptDex/euO.json

    Filesize

    1.9MB

    MD5

    85eae057dacf81778e466815f8c33ef0

    SHA1

    1800ab54a452c663f19af88eb51ee097cfe9d3a3

    SHA256

    8d90c8d478a0c781c59e1e80799b3d63bd63f58fb3afb9e030a8600f1ddec6a2

    SHA512

    0a0c89327362b5360726de60e74ecb1e4cda74bfdaab742750acdfa0c9696e543891463597a556a0d254b502d2c683236bdae69411afde2e84a1f16181a8235a

  • /data/user/0/com.magnet.grain/app_DynamicOptDex/euO.json

    Filesize

    5.0MB

    MD5

    33dcc7f35bac6926eb4392927679d824

    SHA1

    77570304599411155fe15817d13096c56abd8025

    SHA256

    3f4255d87961f30c74719c3df632b52de4a643cf7b932e625580c718fad62180

    SHA512

    3c3681368e2844b3d4aafd0923712dcbc66c436727589fb3b36cc5c9531b6d43ad0095dd0dddc1c3d6112debb32320b02c9b6dafb647bd1b2d0fc77b67c478b7