Analysis

  • max time kernel
    650211s
  • max time network
    94s
  • platform
    android_x64
  • resource
    android-x64-20220621-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220621-enlocale:en-usos:android-10-x64system
  • submitted
    22-07-2022 16:30

General

  • Target

    Google_chrome.apk

  • Size

    4.9MB

  • MD5

    0df076628ae1c36d1a83adb1f0aa9da7

  • SHA1

    e395429b36986a6a9a38b4f8c16f770881bfa9cd

  • SHA256

    d5e69da84b83863f1fce0654244ee69a8dbbdc3727a654c3e06b2e1eb0f27a26

  • SHA512

    30b489ea8a06511955a53b5b605e5f7b78bccf3566ec1f517ea062e5b21c98b8a4cca2bcda9d41a6f7b13cd714e5f9bf695676d92d5a5f336c16fb0dc82d8e03

Malware Config

Extracted

Family

hydra

C2

https://maxnote.site

Signatures

  • Hydra

    Android banker and info stealer.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.gkmsocbet.lfjqpvgnx
    1⤵
    • Loads dropped Dex/Jar
    PID:5372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.gkmsocbet.lfjqpvgnx/g68fI8Iga8/fpIj8feI89f7Ujj/GajU8T6I.8jw8
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.gkmsocbet.lfjqpvgnx/g68fI8Iga8/fpIj8feI89f7Ujj/base.apk.f8iw6ff1.e7g
    Filesize

    5.2MB

    MD5

    706cac8e3d9e62610676018001ebaa33

    SHA1

    9b52814dd1214101427a199b232f789e83ad27f6

    SHA256

    82a1338f2fdae67f475cfe8a1f6b0499c2b674b4a2ddf4f4ed985980f4bf3d38

    SHA512

    34067d0f2936fde5a814be5d67b837c1960672629da01cf6b867864e6e189c86f0a14cbf283d6c9aa211ada779417e7f0b12e346d6a415022102260da4bb1b3f

  • /data/user/0/com.gkmsocbet.lfjqpvgnx/g68fI8Iga8/fpIj8feI89f7Ujj/tmp-base.apk.f8iw6ff7589014983235986681.e7g
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.gkmsocbet.lfjqpvgnx/shared_prefs/multidex.version.xml
    Filesize

    306B

    MD5

    144a7750a1e095704563c62f39b4b24f

    SHA1

    0c90ac2324fb899ec966566edfd33f40456b1542

    SHA256

    300a1e8db1602deff2583a4ce7a6430098e94671fe0d7cbe68f23a4077548887

    SHA512

    ff0a3088d4de292fe7b9d647e9ba93f3882e9016dca39ed70bd09e5735d3c1f151e29b6d607aacad3f11910bb798dc35610e83030cfd77e5daef626d88ddc666