Analysis

  • max time kernel
    650211s
  • max time network
    94s
  • platform
    android_x64
  • resource
    android-x64-20220621-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220621-enlocale:en-usos:android-10-x64system
  • submitted
    22-07-2022 16:30

General

  • Target

    Google_chrome.apk

  • Size

    4.9MB

  • MD5

    0df076628ae1c36d1a83adb1f0aa9da7

  • SHA1

    e395429b36986a6a9a38b4f8c16f770881bfa9cd

  • SHA256

    d5e69da84b83863f1fce0654244ee69a8dbbdc3727a654c3e06b2e1eb0f27a26

  • SHA512

    30b489ea8a06511955a53b5b605e5f7b78bccf3566ec1f517ea062e5b21c98b8a4cca2bcda9d41a6f7b13cd714e5f9bf695676d92d5a5f336c16fb0dc82d8e03

Malware Config

Extracted

Family

hydra

C2

https://maxnote.site

Signatures

  • Hydra

    Android banker and info stealer.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.gkmsocbet.lfjqpvgnx
    1⤵
    • Loads dropped Dex/Jar
    PID:5372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.gkmsocbet.lfjqpvgnx/g68fI8Iga8/fpIj8feI89f7Ujj/base.apk.f8iw6ff1.e7g

    Filesize

    5.2MB

    MD5

    706cac8e3d9e62610676018001ebaa33

    SHA1

    9b52814dd1214101427a199b232f789e83ad27f6

    SHA256

    82a1338f2fdae67f475cfe8a1f6b0499c2b674b4a2ddf4f4ed985980f4bf3d38

    SHA512

    34067d0f2936fde5a814be5d67b837c1960672629da01cf6b867864e6e189c86f0a14cbf283d6c9aa211ada779417e7f0b12e346d6a415022102260da4bb1b3f

  • /data/user/0/com.gkmsocbet.lfjqpvgnx/shared_prefs/multidex.version.xml

    Filesize

    306B

    MD5

    144a7750a1e095704563c62f39b4b24f

    SHA1

    0c90ac2324fb899ec966566edfd33f40456b1542

    SHA256

    300a1e8db1602deff2583a4ce7a6430098e94671fe0d7cbe68f23a4077548887

    SHA512

    ff0a3088d4de292fe7b9d647e9ba93f3882e9016dca39ed70bd09e5735d3c1f151e29b6d607aacad3f11910bb798dc35610e83030cfd77e5daef626d88ddc666