Overview

overview

10

Static

static

7

lolipop.apk

android-9-x86

10

lolipop.apk

android-10-x64

1

lolipop.apk

android-11-x64

1

Analysis

  • max time kernel
    1657408s
  • max time network
    161s
  • platform
    android_x86
  • resource
    android-x86-arm-20220621-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
  • submitted
    03-08-2022 08:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    lolipop.apk

  • Size

    3.2MB

  • MD5

    c18a3b53ef3bdbfbe7ff86b5628912b7

  • SHA1

    6b4bb3c0b598bde22370433765418b64f6e594fd

  • SHA256

    9c9bc75ce675754c655b0757a8655ff50186b1626862bcb5b8200c4047f3ab3c

  • SHA512

    9d176585d882a10d0049060267aedada2954908aa21b1651cde811bcb53ed4bc9fbaefae98388a0613e37940043718c2a6735f96afbff8788f243916c297cb5d

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 2 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.risk.better
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:4108
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.risk.better/app_DynamicOptDex/ItLUbeY.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.risk.better/app_DynamicOptDex/oat/x86/ItLUbeY.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.risk.better/app_DynamicOptDex/ItLUbeY.json
    Filesize

    1.9MB

    MD5

    5eaa6160d6d060625595c6cab1d306f2

    SHA1

    80a6207e2016489e36f451bb4e31001bb771b6f8

    SHA256

    e51744647a7e82b74e00fd4cefa41656d2cf98becb19557f9877b71207a1ef00

    SHA512

    1286b32ecc16d83b844018d5fd6afa0f7599c8033c7001216d70cfb3a1f36b6a8374d865eb1424f1c6dbfb9263bd9bee0d0ebc0fca0eb54d56574894d7c7434f

    Download Submit
  • /data/user/0/com.risk.better/app_DynamicOptDex/ItLUbeY.json
    Filesize

    5.0MB

    MD5

    a43e2638961ce9122b5ab0853b84573f

    SHA1

    e6c6b88b13db4a802e9daca82d5ab1140fb35463

    SHA256

    501464680f3217fbdc7cf1261256c9a42665e83b4fe0167754eaded1bd0ee3f7

    SHA512

    bbdc088b35f7637f7e9098ffc2993a97f37bacba9ae16e045a57d28a85e6bc0d15b40523881e5d9cc41d8bc247c81e4fa7100eab1dd495439913adc2fab1af9c

    Download Submit
  • /data/user/0/com.risk.better/app_DynamicOptDex/ItLUbeY.json
    Filesize

    5.0MB

    MD5

    b94c43d08ab9e1c0e113d3ea55ddafc5

    SHA1

    aea1825d69f60cba1cb2b803d8166cc0ae064024

    SHA256

    3cdbef705127967f7e7aab3f28be5aa92ef3d9f346c3d3fd3674be569f6d70ad

    SHA512

    083fcfc98da1e56ab830fabbb59c6cfcea947ab31b7384f129267c10cf1474b885d73ff835f2803f5838cc925c6e7dd1114afea1a2e286de53dcf089eee45ac0

    Download Submit
  • /data/user/0/com.risk.better/app_DynamicOptDex/ItLUbeY.json.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.risk.better/app_DynamicOptDex/oat/ItLUbeY.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.risk.better/app_DynamicOptDex/oat/x86/ItLUbeY.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.risk.better/app_DynamicOptDex/oat/x86/ItLUbeY.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit