Analysis
-
max time kernel
3834326s -
max time network
120s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
01-04-2022 09:50
General
-
Target
bawag.apk
-
Size
3.4MB
-
MD5
c34d943b9dc1618d424af57cbdfa4a6e
-
SHA1
6e6487c3b689201b43621b47319a7f6514fa64ea
-
SHA256
3fe3d4f0cbdebb784d1a96dc7d9a4ecd4e9c080860bfa87e50084930aa0d4198
-
SHA512
b46ae181e732b00c3eebef1b2e30db786a2a28075de072f98baf54c84cbff674c74500add8f0b58a674cc566f6b982c8c010629102dd3a1a94f8cd92996d78c3
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra Payload 2 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Reads information about phone network operator.
Processes
-
com.shell.wisdom1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.shell.wisdom/app_DynamicOptDex/QW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.shell.wisdom/app_DynamicOptDex/oat/x86/QW.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
toolbox ps2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5e90093d30a7aaed33b9984ef6fce03e2
SHA1033b019451b6ec0d16c2696350997b0165da5592
SHA25619048e1ca07a6e8ab37fd2e8e11affb9f0544a37d31f57102a1a08a53b79bc50
SHA512e0109cbfdae46c96207fe13c6af2dc1c86156d04ce96e2c396e0fb1babc5f5865ab84457d25999f19637cb73264ea01c1d5f7e2b9995449f184cf8bb694da93c
-
Filesize
5.0MB
MD595627d9ea16d4f36ad3022c65578e2df
SHA14f0ce633c5706f67134a6d9c549b3af74536acd2
SHA25654afc9432c3ab50212abe34671bf6afc6de747cf05959991271ce536249ed594
SHA512dee709a1c1029342418d475ffc13ec3dee1dc27c2c9aa8804d3e3478bd47720159287ca824fb3fe63f1d4ceaeed269575331711f7ab038f1353fff7af8354e20
-
Filesize
5.0MB
MD5412826ee6d6fab98a5471008a2cd1118
SHA117ae43b5a9128d4df9c140833bf696c42bf04ccb
SHA25626fdc35c4216c1b7a810ac2e341630cca4b5faa92561df7c42ccb6ea408a8d7f
SHA5128f2c5b00a730a114384f7250d2a728283909da3849bdc6f2a222891a318db520fa414ff03135afb07bf3ef44aa5af8d5efb716f1a74cf4221a5c89321d963678
-
Filesize
422B
MD5d677c5f4f107f72272e4313a23372507
SHA141400d3e8b23e61de2f7078005c87852b7b5ed4a
SHA256924b9034d71e7a7cb105c1fc9731b0ae25690db2f4fc50fb3e1e0fb3db9c2e54
SHA512d36168a2eaf2167002d99500ba906bd7fb6cbdbcf14a2d257dabfdd8c271783ed95e827dcd96571813e4d67f5a78cc9e70598c7b6257af9127f110ef13d9f14a
-
Filesize
3.9MB
MD59893523429f07b4ddc82e4133ff6603d
SHA1ff83ad73de7672c77edf8888f4b241642c7c90f7
SHA256d79a14e1b685ec9cfb3e9a489b9650e4092eccc468c9eef4222765857e83d96e
SHA5122346a2d1616894b350fdcc6833f33a16bc031809ce80160f35af78b05a9c867d722979cdb3725c5bcddaa54518c58d88b0320a20da5f752a03c2c4758b84126a
-
Filesize
2.2MB
MD53a6750bc0ab780292491c6a2b2bdc2e8
SHA1b1cdbfeb7c88f82ef3b5289cafeed1321fa4693f
SHA25626e2b88c992873131ba6422d6eb8f6ced94add2f5abfdbe3dcca4cbd79861d67
SHA512f7a1c555b8fdea9a132367d2c0d6396c0045bf13375a3b64b686f7ea34b8ed6868d9253ca1902fbd2538994482f363045be771596d3a2c0a6a017b03903b36c7
-
Filesize
6.7MB
MD58f75c0f064ae808474d98334419374b2
SHA12541a68db820e825e40f8955baf9148113afbc49
SHA25660c73335d1aca9219ec0c355e201d46160549b47534f1074751d4f0dc0f2d506
SHA51241439bf307f77343e123aedf83bed1ad2d77faaeecdd9daa2c447d1a2b8e6bb44aca861a950161a0298f7150c37480e5d22126a466025de8f10c9d083e96e58f
-
Filesize
6.9MB
MD55183e07a25ec7654bbd9405b5f1a4c75
SHA125057eeb42ff82668cd49b9e1bcfc39b2229955d
SHA2564119996e6e2c6a57ad245c40368732972eeaf40bc9e2c22c396d69afeb4bea15
SHA512a1bbd42ff89c21025404185e28ffea01906860b41ae6bb6e5d725ef28b8131e9501da7798ff0807f300cf018132e06c176332c1aa31939676bdf0cc08a3f1194
-
Filesize
123B
MD5882a5c7bb55ad342d352770ad1a04c90
SHA1b048a9cf4926febbed82f2804207bd7576a8e8e0
SHA256caa24da47c90ed4a260ee260ecd1dab3f8937688e82ae0a3705703b38da43278
SHA5129f3863f873fdb5625d251d0bd1cdd52f683844ead8e458571e21af4f65c947c2da0cdb3036ca4e1d9d7ca4cccbb097aaea1e253604b99a3965d4a2c4f04f97ec
-
Filesize
408B
MD524f17d66e55e4de3de6d88475077e270
SHA17596fa7c4a2e444869dc603f11dff8257eb2d147
SHA256b8bc668e38ce95822e1c4fe4a7deda001859947b9ef4d039a7e13d05d1e98990
SHA51263433db5fe0b190d7d030629a79a35ec550c41450f79e8931bbbda871e1cb74e32d0b4a2444484227345b1daa5814698b3cdf4e5ab6ff6646603fa725bece6a6