Analysis

  • max time kernel
    2888043s
  • max time network
    135s
  • platform
    android_x64
  • resource
    android-x64-20220621-en
  • submitted
    28-06-2022 21:05

General

  • Target

    0fd6d7acae3f279bd5194c06e33ce37d.apk

  • Size

    3.2MB

  • MD5

    0fd6d7acae3f279bd5194c06e33ce37d

  • SHA1

    854c6ed6db41c47f16f6e43f375fa8d611592866

  • SHA256

    d449c3e618ae655b697ccb37618333c6c0fd095a7385a383efc2bcac377818e8

  • SHA512

    f6c3cf38f39f3a9bdbc41342bb2c69b0201307d22bae3aeb56e8a34d53993a0f9f0aa463ce99217b062f010d111f349eb33fc3cf099768a9314dd48613e6361c

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Reads information about phone network operator.

Processes

  • com.issue.witness
    1⤵
    • Loads dropped Dex/Jar
    PID:6128
    • toolbox ps
      2⤵
        PID:6456
      • /system/bin/sh -c /data/data/com.issue.witness/files/tor_source/tor.so DataDirectory /data/data/com.issue.witness/app_data --defaults-torrc /data/data/com.issue.witness/files/tor_source/torrc -f /data/data/com.issue.witness/files/tor_source/torrc.custom --verify-config
        2⤵
          PID:6546

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Command and Control

      Web Service

      1
      T1102

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/user/0/com.issue.witness/app_DynamicOptDex/cJkt.json
        Filesize

        1.9MB

        MD5

        b17723d8f543993edfc6cbc213bc3a6d

        SHA1

        4e45a8f931d31313527324042ea5907f28d5c05c

        SHA256

        b57ce5c3187f4ef6630ffdfc6ec27f6180f4f3eb32c35587188ab0b852c82fb2

        SHA512

        a8c45b6779d1883e32dea949ae5ba55b3e40f545908aa18e0ceaeb8659855e3a7a69a835c5b8f946869817b8169d844d96ddfd6c626a4953bf1114c1b870483f

      • /data/user/0/com.issue.witness/app_DynamicOptDex/cJkt.json
        Filesize

        5.0MB

        MD5

        b42b9d7a408b0e1e52109b9695f2e6eb

        SHA1

        beff86894edf19b07374ec23339d633bafcc103f

        SHA256

        f461b5a0ac8dc0516a71c6ea2306abfd876d9324bc11adec950456255e7540f1

        SHA512

        7c726032d649d76a1c3a7b9e8c6ab6845bb2c3561933202a4748400d39e72f5c1f816cc2a1445a8bc15c08049eae3e171442b3880e42a09a74b3981c071f2603

      • /data/user/0/com.issue.witness/app_DynamicOptDex/oat/cJkt.json.cur.prof
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • /data/user/0/com.issue.witness/files/all_tor.zip
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • /data/user/0/com.issue.witness/files/all_tor/arm64-v8a/obfs4proxy.so
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • /data/user/0/com.issue.witness/files/all_tor/arm64-v8a/tor.so
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • /data/user/0/com.issue.witness/files/all_tor/armeabi-v7a/obfs4proxy.so
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • /data/user/0/com.issue.witness/files/all_tor/armeabi-v7a/tor.so
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • /data/user/0/com.issue.witness/files/all_tor/bridges.txt
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • /data/user/0/com.issue.witness/files/all_tor/geoip
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • /data/user/0/com.issue.witness/files/all_tor/geoip6
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • /data/user/0/com.issue.witness/files/all_tor/torrc
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • /data/user/0/com.issue.witness/files/tor_source/bridges.txt
        Filesize

        422B

        MD5

        d677c5f4f107f72272e4313a23372507

        SHA1

        41400d3e8b23e61de2f7078005c87852b7b5ed4a

        SHA256

        924b9034d71e7a7cb105c1fc9731b0ae25690db2f4fc50fb3e1e0fb3db9c2e54

        SHA512

        d36168a2eaf2167002d99500ba906bd7fb6cbdbcf14a2d257dabfdd8c271783ed95e827dcd96571813e4d67f5a78cc9e70598c7b6257af9127f110ef13d9f14a

      • /data/user/0/com.issue.witness/files/tor_source/geoip
        Filesize

        3.9MB

        MD5

        9893523429f07b4ddc82e4133ff6603d

        SHA1

        ff83ad73de7672c77edf8888f4b241642c7c90f7

        SHA256

        d79a14e1b685ec9cfb3e9a489b9650e4092eccc468c9eef4222765857e83d96e

        SHA512

        2346a2d1616894b350fdcc6833f33a16bc031809ce80160f35af78b05a9c867d722979cdb3725c5bcddaa54518c58d88b0320a20da5f752a03c2c4758b84126a

      • /data/user/0/com.issue.witness/files/tor_source/geoip6
        Filesize

        2.2MB

        MD5

        3a6750bc0ab780292491c6a2b2bdc2e8

        SHA1

        b1cdbfeb7c88f82ef3b5289cafeed1321fa4693f

        SHA256

        26e2b88c992873131ba6422d6eb8f6ced94add2f5abfdbe3dcca4cbd79861d67

        SHA512

        f7a1c555b8fdea9a132367d2c0d6396c0045bf13375a3b64b686f7ea34b8ed6868d9253ca1902fbd2538994482f363045be771596d3a2c0a6a017b03903b36c7

      • /data/user/0/com.issue.witness/files/tor_source/obfs4proxy.so
        Filesize

        6.7MB

        MD5

        8f75c0f064ae808474d98334419374b2

        SHA1

        2541a68db820e825e40f8955baf9148113afbc49

        SHA256

        60c73335d1aca9219ec0c355e201d46160549b47534f1074751d4f0dc0f2d506

        SHA512

        41439bf307f77343e123aedf83bed1ad2d77faaeecdd9daa2c447d1a2b8e6bb44aca861a950161a0298f7150c37480e5d22126a466025de8f10c9d083e96e58f

      • /data/user/0/com.issue.witness/files/tor_source/tor.so
        Filesize

        6.9MB

        MD5

        5183e07a25ec7654bbd9405b5f1a4c75

        SHA1

        25057eeb42ff82668cd49b9e1bcfc39b2229955d

        SHA256

        4119996e6e2c6a57ad245c40368732972eeaf40bc9e2c22c396d69afeb4bea15

        SHA512

        a1bbd42ff89c21025404185e28ffea01906860b41ae6bb6e5d725ef28b8131e9501da7798ff0807f300cf018132e06c176332c1aa31939676bdf0cc08a3f1194

      • /data/user/0/com.issue.witness/files/tor_source/torrc
        Filesize

        123B

        MD5

        882a5c7bb55ad342d352770ad1a04c90

        SHA1

        b048a9cf4926febbed82f2804207bd7576a8e8e0

        SHA256

        caa24da47c90ed4a260ee260ecd1dab3f8937688e82ae0a3705703b38da43278

        SHA512

        9f3863f873fdb5625d251d0bd1cdd52f683844ead8e458571e21af4f65c947c2da0cdb3036ca4e1d9d7ca4cccbb097aaea1e253604b99a3965d4a2c4f04f97ec

      • /data/user/0/com.issue.witness/files/tor_source/torrc.custom
        Filesize

        409B

        MD5

        cef4659b54b5d3a878ce29c3cf6e2954

        SHA1

        5d399de342e9fc2beaf20afed14090287d0963a4

        SHA256

        6ba40d4b8d55ce247ff93017e8a92d367291c6cd1a2c50a16c1fb6c55be0a758

        SHA512

        8e042e9adc477577880eda8fd27e65e0742f3f499a7d5ce1b6c91776b422f36ebd58c01db230236671aad6f57a1a54512afa3fe1a5ae131cf44872638f17dc4c