Analysis

  • max time kernel
    3681577s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    19-05-2022 08:27

General

  • Target

    FlashPlayerV1.apk

  • Size

    2.7MB

  • MD5

    dc09a6ce2314a97a4515df60a3628daa

  • SHA1

    f00e5ddd740e8bfc996a03258efe4fd9445afc2d

  • SHA256

    b7440319d58586bd84fcbce0573ec9c424fc5e8203f16a45bc689b035561d22c

  • SHA512

    8fbab5efe65d29961f1c91c0499578d531ef5651ca7d70d9e28f365318408fb29cb1758e68c1364236f3c8860d9c0963eaa703fcb75de27bf0763e49f99af40d

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

Processes

  • com.people.charge
    1⤵
    • Loads dropped Dex/Jar
    PID:6286

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.people.charge/app_DynamicOptDex/nWfmsQ.json
    Filesize

    1.9MB

    MD5

    e1a868e3f1bf499163b68cf3d32f5f65

    SHA1

    4a9dd5872949fcedb4a6080c8b0563b08108b148

    SHA256

    16d26baabf2db6ab8c9a628b71402556319aa86cebb39bab7ddf058cf99520c6

    SHA512

    db410ac9acadbd77bad6fb92e5934322d964b4d8b45af1755e705622b8bc82e4896b8c233aaa73635b3134b7476fc9e339dae0bfba52460da38b2a5381423c59

  • /data/user/0/com.people.charge/app_DynamicOptDex/nWfmsQ.json
    Filesize

    5.0MB

    MD5

    6bd544d275c8f049391a46371d03862d

    SHA1

    06c6091dab4fc3e91d62f1ae87a8a16356f234f1

    SHA256

    4079e84dbc452d7a2bfba40b54dec85b6d4803566aef777df3d58ba073906db8

    SHA512

    f29eea4dbeb32bd52cdfcb493124c93c923f34a263ae7c61ab4b5f6804af48bec0bf78b65a63e783f0fb195c06d2cb398933399ab92c60327888e3367c436758

  • /data/user/0/com.people.charge/app_DynamicOptDex/oat/nWfmsQ.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e