Overview

overview

10

Static

static

7

latte.apk

android-9-x86

10

latte.apk

android-10-x64

10

latte.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    latte.apk

  • Size

    3.2MB

  • Sample

    220803-j54l2saahk

  • MD5

    2766fe2cc89890935127ae864f88a309

  • SHA1

    f7dc91ed1d4c85e72896b22acb9f192a36ca9ae3

  • SHA256

    93c5e98c06963c8a320f5876148ad45fb6cce1a40a7aaee195cfa5027e19426b

  • SHA512

    a9b59137d044d134417f63d38c361b9f5961f10915794a70c65e95a06bd6bdb5299325915b32be398808aabfd7aad5faea5a6b6617261b20a54f0fabb54f3ecb

Score
10/10
hydraandroidbankerinfostealertrojan

Malware Config

Targets

    • Target

      latte.apk

    • Size

      3.2MB

    • MD5

      2766fe2cc89890935127ae864f88a309

    • SHA1

      f7dc91ed1d4c85e72896b22acb9f192a36ca9ae3

    • SHA256

      93c5e98c06963c8a320f5876148ad45fb6cce1a40a7aaee195cfa5027e19426b

    • SHA512

      a9b59137d044d134417f63d38c361b9f5961f10915794a70c65e95a06bd6bdb5299325915b32be398808aabfd7aad5faea5a6b6617261b20a54f0fabb54f3ecb

    Score
    10/10
    hydrabankerinfostealertrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks