Analysis
-
max time kernel
3454925s -
max time network
140s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
16-05-2022 16:23
Static task
static1
Behavioral task
behavioral1
Sample
3529ee191fc7d8a351436adb058e1b3d4f1ab460638eb26eda1e0b5e98800dbb.apk
Resource
android-x86-arm-20220310-en
Behavioral task
behavioral2
Sample
3529ee191fc7d8a351436adb058e1b3d4f1ab460638eb26eda1e0b5e98800dbb.apk
Resource
android-x64-20220310-en
Behavioral task
behavioral3
Sample
3529ee191fc7d8a351436adb058e1b3d4f1ab460638eb26eda1e0b5e98800dbb.apk
Resource
android-x64-arm64-20220310-en
General
-
Target
3529ee191fc7d8a351436adb058e1b3d4f1ab460638eb26eda1e0b5e98800dbb.apk
-
Size
5.1MB
-
MD5
814cc255fb09aa69934a0bd6209e2cc2
-
SHA1
ca78b55c86c329788806019c1eae1137ee48ee10
-
SHA256
3529ee191fc7d8a351436adb058e1b3d4f1ab460638eb26eda1e0b5e98800dbb
-
SHA512
9dfb359ea71622c0c33490d77c42912238398ce4e0a9ca5070329348b289c1bfd55ae4e165408d20ec6c9fccd4059701b7689c7ca2472212660a2f46be88805e
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra Payload 3 IoCs
Processes:
resource yara_rule /data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.json family_hydra /data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.json family_hydra /data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.json family_hydra -
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
fqey.lyrcbotqgnnwolmxceln.lsagadescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId fqey.lyrcbotqgnnwolmxceln.lsaga Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId fqey.lyrcbotqgnnwolmxceln.lsaga -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
fqey.lyrcbotqgnnwolmxceln.lsaga/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/oat/x86/fbSikw.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.json 5181 fqey.lyrcbotqgnnwolmxceln.lsaga /data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.json 5309 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/oat/x86/fbSikw.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.json 5181 fqey.lyrcbotqgnnwolmxceln.lsaga -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 60 ip-api.com -
Reads information about phone network operator.
Processes
-
fqey.lyrcbotqgnnwolmxceln.lsaga1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/oat/x86/fbSikw.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.jsonFilesize
3.1MB
MD5fa96d6100853806e22dbd72cf4539f1d
SHA12e4343ac254eaa7952802e0d5a31f60ed3f68bf0
SHA25616b26a153b64156b279b866747990bfd029e637118805f8f29788c0a1da81b1f
SHA512d25221e9f9ff90fd7da750bd8a94f6dcba62a7fd3245252d42f6af30f14c813ae5926d0eea9829d3d3ccf7a408bcb2ca54b2acda56ba0b921e02c26f794fd4e2
-
/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.jsonFilesize
3.1MB
MD52220a66512924e0ced83a2df6a9d6cc9
SHA1f839a63c6e4526f61be861b32bd3f336e1b5b7d3
SHA256f30aed324101c4b87e153eb066e98722558bd1d2fc4fb80820e4978ff623a19c
SHA5124b5c638ce74be2c38910e2b92852910afd194b12456d5836aed9e1472b25345a82aad0598728eeee7cdcd54e5be697a145e4802e7e900716cf18763672a4a9aa
-
/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.jsonFilesize
3.1MB
MD52ba22000ec76b4b56391caa00b952d9e
SHA1723f23a146a8b1ec0c8408c822d491d49194db24
SHA256157d796c0331e3bfd643349e56ef6bd9cde47004eb995be43ab57f4198f66ccb
SHA512a443aa5d8751e5b30dd22ba5bc0c1407ef6a678965a1b015be6afaf79407af947b7ec2fe06edbd1ce36ef9a08fb2572c8db0fcb43b38da9a91f25e919115f0db
-
/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.jsonFilesize
3.1MB
MD52220a66512924e0ced83a2df6a9d6cc9
SHA1f839a63c6e4526f61be861b32bd3f336e1b5b7d3
SHA256f30aed324101c4b87e153eb066e98722558bd1d2fc4fb80820e4978ff623a19c
SHA5124b5c638ce74be2c38910e2b92852910afd194b12456d5836aed9e1472b25345a82aad0598728eeee7cdcd54e5be697a145e4802e7e900716cf18763672a4a9aa
-
/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/fbSikw.json.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/oat/fbSikw.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/oat/x86/fbSikw.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/fqey.lyrcbotqgnnwolmxceln.lsaga/app_DynamicOptDex/oat/x86/fbSikw.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e