Overview

overview

10

Static

static

7

FlashPlayerV1.apk

android_x86

10

FlashPlayerV1.apk

android_x64

10

FlashPlayerV1.apk

android_x64

10

Analysis

  • max time kernel
    1115292s
  • max time network
    151s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    08/06/2022, 08:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    FlashPlayerV1.apk

  • Size

    3.2MB

  • MD5

    fa081ed138a34e5b8ca7e2677230eada

  • SHA1

    b5f8d1ece1b7a1b80bb3590fe745a657ebdeaca9

  • SHA256

    d1a0e02d4ae782c65dadba7016fba59fd9692daff9b6a10a5c11a866fa24a474

  • SHA512

    733ef67176c515110bff56d0235ae857d88cd9013aa1bbecbcbc18d87b35e1105dd078e6f4c6bfba8d496a139fdedbf9466f1a23fe85441fb6c5efe271d5b894

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra Payload 2 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.coil.much
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:5123
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.coil.much/app_DynamicOptDex/boI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.coil.much/app_DynamicOptDex/oat/x86/boI.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5155

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.coil.much/app_DynamicOptDex/boI.json
    Filesize

    1.9MB

    MD5

    6b07a8de0cab86fde5faadad7ecc6596

    SHA1

    0ca9de6a6d7b3f6b5ecbb6655351e4394e6a7848

    SHA256

    3abf07b4cf819794a57098cfda493012ca75f05148e7d9757e06c2d131cd3b1a

    SHA512

    3226a93fe2fdd4692dd377e63c51841e48437296d410a0b860efaac70c131da06a7746a5ad441f32b6e07c0096ddbb733c41c4d5647a469db0ae4d23a101e124

    Download Submit

  • /data/user/0/com.coil.much/app_DynamicOptDex/boI.json
    Filesize

    5.0MB

    MD5

    ff0de7a8ac12629d79bae6473713782e

    SHA1

    c781723078414eed414d1130d4c2833afb12337e

    SHA256

    995c8aa9282b8e9d3a250beb8f2d15626186b58d76c86e7e3d147c0c00a7799b

    SHA512

    24f5a065613716ff9fdcbc4c3a738eba8dae0c66064152bb8e4cf347b3216dc6aef2bd98e39a768c3e227a60282772c162da2d836b4e4818aeb655b850067942

    Download Submit

  • /data/user/0/com.coil.much/app_DynamicOptDex/boI.json
    Filesize

    5.0MB

    MD5

    d95f1101eeab1f220343e0ed048ef7c0

    SHA1

    cdc16afc942ad5a8d4b6ceae23edbcfa67ecd01a

    SHA256

    33da05b58fd65c304b74a640a9851b5f6783ee6a7272e4b60908663c35fea4b7

    SHA512

    166a8d8e20046d6437da342e01203aa951b68eb1bc4da8d2b7ec6ac1a4a73a4121a49df7e4ebd27bf48a51b5050c36cbb836cce747c50bdeb4ac0254b783497f

    Download Submit