Overview

overview

10

Static

static

7

bawag.apk

android_x86

10

bawag.apk

android_x64

10

bawag.apk

android_x64

10

Analysis

  • max time kernel
    4092997s
  • max time network
    153s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    04-04-2022 09:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bawag.apk

  • Size

    3.3MB

  • MD5

    3fd6cadb8e556a5b6a65c5e88d7bcb3d

  • SHA1

    cc9c0d48261bf2a68d236360b80ac6af1e2aa59c

  • SHA256

    5c750209d2f8d60504708a4107e7e11b6f4d3b425e7f98b2549635aece29e6a1

  • SHA512

    28f6010325c1c600b4ec4936a298fcc5ae163384bf5c177e9ef1161539c24261be84cb63954c84e42277e408b20f961adfb4f4e45cf5e1e120d6b794c5543c48

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra Payload 2 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Reads information about phone network operator.

Processes

  • com.warm.sight
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:5334
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.warm.sight/app_DynamicOptDex/efX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.warm.sight/app_DynamicOptDex/oat/x86/efX.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5411
    • toolbox ps
      2⤵
        PID:5897
      • /system/bin/sh -c /data/data/com.warm.sight/files/tor_source/tor.so DataDirectory /data/data/com.warm.sight/app_data --defaults-torrc /data/data/com.warm.sight/files/tor_source/torrc -f /data/data/com.warm.sight/files/tor_source/torrc.custom --verify-config
        2⤵
          PID:5972
        • /system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.warm.sight/files/tor_source/tor.so /data/data/com.warm.sight/files/tor_source/tor.so DataDirectory /data/data/com.warm.sight/app_data --defaults-torrc /data/data/com.warm.sight/files/tor_source/torrc -f /data/data/com.warm.sight/files/tor_source/torrc.custom --verify-config
          2⤵
            PID:5972
          • /system/bin/sh -c /data/data/com.warm.sight/files/tor_source/tor.so DataDirectory /data/data/com.warm.sight/app_data --defaults-torrc /data/data/com.warm.sight/files/tor_source/torrc -f /data/data/com.warm.sight/files/tor_source/torrc.custom
            2⤵
              PID:6034
            • /system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.warm.sight/files/tor_source/tor.so /data/data/com.warm.sight/files/tor_source/tor.so DataDirectory /data/data/com.warm.sight/app_data --defaults-torrc /data/data/com.warm.sight/files/tor_source/torrc -f /data/data/com.warm.sight/files/tor_source/torrc.custom
              2⤵
                PID:6034
              • toolbox ps
                2⤵
                  PID:6713
                • /system/bin/sh -c /data/data/com.warm.sight/files/tor_source/tor.so DataDirectory /data/data/com.warm.sight/app_data --defaults-torrc /data/data/com.warm.sight/files/tor_source/torrc -f /data/data/com.warm.sight/files/tor_source/torrc.custom --verify-config
                  2⤵
                    PID:6737
                  • /system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.warm.sight/files/tor_source/tor.so /data/data/com.warm.sight/files/tor_source/tor.so DataDirectory /data/data/com.warm.sight/app_data --defaults-torrc /data/data/com.warm.sight/files/tor_source/torrc -f /data/data/com.warm.sight/files/tor_source/torrc.custom --verify-config
                    2⤵
                      PID:6737

                  Network

                  MITRE ATT&CK Matrix ATT&CK v6

                  Initial Access

                  Execution

                  Persistence

                  Privilege Escalation

                  Defense Evasion

                  Credential Access

                  Discovery

                  Lateral Movement

                  Collection

                  Exfiltration

                  Command and Control

                  Web Service

                  1
                  T1102

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • /data/data/com.warm.sight/files/control.txt.tmp
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/data/com.warm.sight/files/control.txt.tmp
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/app_DynamicOptDex/efX.json
                    Filesize

                    1.9MB

                    MD5

                    d0913312842e525724e2dc2e40c7c9cb

                    SHA1

                    26ba59c7cc6db3e69032376649d83fe826a2039f

                    SHA256

                    f2de5b9c0831038c702f36a7c246ac388e9dcf727a144d47da6b483768d0ef2c

                    SHA512

                    bd63ef4bec6390f85500301bcc07ce197ccbce73aa4d54d700ae2a878daf77daa97bd330a6c999d5640dfd7ee8b7d403bc620519c902a1c2bb6fc50419b730e0

                    Download Submit
                  • /data/user/0/com.warm.sight/app_DynamicOptDex/efX.json
                    Filesize

                    5.0MB

                    MD5

                    95627d9ea16d4f36ad3022c65578e2df

                    SHA1

                    4f0ce633c5706f67134a6d9c549b3af74536acd2

                    SHA256

                    54afc9432c3ab50212abe34671bf6afc6de747cf05959991271ce536249ed594

                    SHA512

                    dee709a1c1029342418d475ffc13ec3dee1dc27c2c9aa8804d3e3478bd47720159287ca824fb3fe63f1d4ceaeed269575331711f7ab038f1353fff7af8354e20

                    Download Submit
                  • /data/user/0/com.warm.sight/app_DynamicOptDex/efX.json
                    Filesize

                    5.0MB

                    MD5

                    412826ee6d6fab98a5471008a2cd1118

                    SHA1

                    17ae43b5a9128d4df9c140833bf696c42bf04ccb

                    SHA256

                    26fdc35c4216c1b7a810ac2e341630cca4b5faa92561df7c42ccb6ea408a8d7f

                    SHA512

                    8f2c5b00a730a114384f7250d2a728283909da3849bdc6f2a222891a318db520fa414ff03135afb07bf3ef44aa5af8d5efb716f1a74cf4221a5c89321d963678

                    Download Submit
                  • /data/user/0/com.warm.sight/app_DynamicOptDex/efX.json.x86.flock
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/app_DynamicOptDex/oat/efX.json.cur.prof
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/app_DynamicOptDex/oat/x86/efX.odex
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/app_DynamicOptDex/oat/x86/efX.vdex
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/files/all_tor.zip
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/files/all_tor/arm64-v8a/obfs4proxy.so
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/files/all_tor/arm64-v8a/tor.so
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/files/all_tor/armeabi-v7a/obfs4proxy.so
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/files/all_tor/armeabi-v7a/tor.so
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/files/all_tor/bridges.txt
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/files/all_tor/geoip
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/files/all_tor/geoip6
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/files/all_tor/torrc
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit
                  • /data/user/0/com.warm.sight/files/tor_source/bridges.txt
                    Filesize

                    422B

                    MD5

                    d677c5f4f107f72272e4313a23372507

                    SHA1

                    41400d3e8b23e61de2f7078005c87852b7b5ed4a

                    SHA256

                    924b9034d71e7a7cb105c1fc9731b0ae25690db2f4fc50fb3e1e0fb3db9c2e54

                    SHA512

                    d36168a2eaf2167002d99500ba906bd7fb6cbdbcf14a2d257dabfdd8c271783ed95e827dcd96571813e4d67f5a78cc9e70598c7b6257af9127f110ef13d9f14a

                    Download Submit
                  • /data/user/0/com.warm.sight/files/tor_source/geoip
                    Filesize

                    3.9MB

                    MD5

                    9893523429f07b4ddc82e4133ff6603d

                    SHA1

                    ff83ad73de7672c77edf8888f4b241642c7c90f7

                    SHA256

                    d79a14e1b685ec9cfb3e9a489b9650e4092eccc468c9eef4222765857e83d96e

                    SHA512

                    2346a2d1616894b350fdcc6833f33a16bc031809ce80160f35af78b05a9c867d722979cdb3725c5bcddaa54518c58d88b0320a20da5f752a03c2c4758b84126a

                    Download Submit
                  • /data/user/0/com.warm.sight/files/tor_source/geoip6
                    Filesize

                    2.2MB

                    MD5

                    3a6750bc0ab780292491c6a2b2bdc2e8

                    SHA1

                    b1cdbfeb7c88f82ef3b5289cafeed1321fa4693f

                    SHA256

                    26e2b88c992873131ba6422d6eb8f6ced94add2f5abfdbe3dcca4cbd79861d67

                    SHA512

                    f7a1c555b8fdea9a132367d2c0d6396c0045bf13375a3b64b686f7ea34b8ed6868d9253ca1902fbd2538994482f363045be771596d3a2c0a6a017b03903b36c7

                    Download Submit
                  • /data/user/0/com.warm.sight/files/tor_source/obfs4proxy.so
                    Filesize

                    6.7MB

                    MD5

                    8f75c0f064ae808474d98334419374b2

                    SHA1

                    2541a68db820e825e40f8955baf9148113afbc49

                    SHA256

                    60c73335d1aca9219ec0c355e201d46160549b47534f1074751d4f0dc0f2d506

                    SHA512

                    41439bf307f77343e123aedf83bed1ad2d77faaeecdd9daa2c447d1a2b8e6bb44aca861a950161a0298f7150c37480e5d22126a466025de8f10c9d083e96e58f

                    Download Submit
                  • /data/user/0/com.warm.sight/files/tor_source/tor.so
                    Filesize

                    6.9MB

                    MD5

                    5183e07a25ec7654bbd9405b5f1a4c75

                    SHA1

                    25057eeb42ff82668cd49b9e1bcfc39b2229955d

                    SHA256

                    4119996e6e2c6a57ad245c40368732972eeaf40bc9e2c22c396d69afeb4bea15

                    SHA512

                    a1bbd42ff89c21025404185e28ffea01906860b41ae6bb6e5d725ef28b8131e9501da7798ff0807f300cf018132e06c176332c1aa31939676bdf0cc08a3f1194

                    Download Submit
                  • /data/user/0/com.warm.sight/files/tor_source/torrc
                    Filesize

                    123B

                    MD5

                    882a5c7bb55ad342d352770ad1a04c90

                    SHA1

                    b048a9cf4926febbed82f2804207bd7576a8e8e0

                    SHA256

                    caa24da47c90ed4a260ee260ecd1dab3f8937688e82ae0a3705703b38da43278

                    SHA512

                    9f3863f873fdb5625d251d0bd1cdd52f683844ead8e458571e21af4f65c947c2da0cdb3036ca4e1d9d7ca4cccbb097aaea1e253604b99a3965d4a2c4f04f97ec

                    Download Submit
                  • /data/user/0/com.warm.sight/files/tor_source/torrc.custom
                    Filesize

                    406B

                    MD5

                    46adaf293728323dbbbb1914746c38b7

                    SHA1

                    a5cb5e01c3b01b656eb6d37d30899d2d84d8fa7d

                    SHA256

                    ea83119b49ebf5ea292f5d07160c1dd72aff172911ca910b0b56040cd0ca1fc7

                    SHA512

                    6a06f6a60fa918279068b20a2d5d6135947ef8d8ade10c1d2e318d7c3f2dfea5f44d5483a1b8581854b21fbd15206443432e2f90a171cd9c92c1544418ad74a4

                    Download Submit