Analysis
-
max time kernel
2142694s -
max time network
162s -
platform
android_x64 -
resource
android-x64-arm64-20220621-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system -
submitted
08-08-2022 23:05
Static task
static1
Behavioral task
behavioral1
Sample
57837f13ac963a450bd76253e3d9196c.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral2
Sample
57837f13ac963a450bd76253e3d9196c.apk
Resource
android-x64-20220621-en
Behavioral task
behavioral3
Sample
57837f13ac963a450bd76253e3d9196c.apk
Resource
android-x64-arm64-20220621-en
General
-
Target
57837f13ac963a450bd76253e3d9196c.apk
-
Size
2.6MB
-
MD5
57837f13ac963a450bd76253e3d9196c
-
SHA1
300b9f20c226f682b4c558e2ac5079241de4af16
-
SHA256
585c602a6cc1ef9d397a15cd74b16e7cf9b24852a675afb1ea5c652ac30b2a74
-
SHA512
3a2978fcfe5167141171afe097ea775073bf0af1d43fa25db3a954d57d566fe563f243b78d5ab6264b0ee31ee6b74413d844f21ff275d70f0e82a9da57b87f93
Malware Config
Extracted
hydra
https://notpro.top
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
resource yara_rule behavioral3/memory/4404-0.dex family_hydra -
Makes use of the framework's Accessibility service. 2 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.tape.lens Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.tape.lens -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.tape.lens/app_DynamicOptDex/LHbULyr.json 4404 com.tape.lens
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5d6c02f734e5c11d2d9b7d99ce45f0614
SHA199be87728f6e40a281308f757de21009ad300999
SHA2563421c58e748451de19bd040ec7ba7161e2cf86f7177947ce113c816d9611ea14
SHA51266ddc997ff30eb26bbe30c6042ebcad1c06ed91c903a89ae604bcb5c2b79e03edf155cf2b4a2b3d32c972039cd9eb84b40d37f3e7aa9cc1a7e612c8571a1606f
-
Filesize
3.6MB
MD51ac811f13e7af6ac317eeab6259db820
SHA153d33fd1dd359b3c2df4ba3cb01787bfa21c84d6
SHA256ce800af9e0272632c3d109cb47b9f941d4044bab80a07db0e3b288c657346aa4
SHA5127a314a8f22af2a9c1bf84555efce6404642af558d987d2103f9dfe0d36afaccac6a11f3f299d3f52424c8df06e02088bec780e48ff99565ae5d7c9f8f1c91b09
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f