Analysis
-
max time kernel
2211542s -
max time network
150s -
platform
android_x86 -
resource
android-x86-arm-20220621-en -
resource tags
-
submitted
09-08-2022 18:12
General
-
Target
af2a369aaacd253f2265b1a73748c47946c4a0bc82a56f073f696630daaef44b.apk
-
Size
3.2MB
-
MD5
438313a34c7d4dd7542930f6abade1d6
-
SHA1
f8baf32d3214cd35756ce2f753a9e7cdb80e6ea4
-
SHA256
af2a369aaacd253f2265b1a73748c47946c4a0bc82a56f073f696630daaef44b
-
SHA512
54909a117fc5296ed3d301ca498c03caadfa8bb049922da7c09cd17db3e506d91752ea8ba429bd0a84438d9079e6d7bfb4e37306578d0483cb0292c21550f305
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Reads information about phone network operator.
Processes
-
com.decide.across1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.decide.across/app_DynamicOptDex/Sr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.decide.across/app_DynamicOptDex/oat/x86/Sr.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD54ea8ace328f08f6c6b92ebc813cd1fd4
SHA1c89d5c6e642f48bbbcefe3b88717fb31f1cac370
SHA2563cdc27ce5e68935ece7770690d175077121ed45466faa2fddef3a99a84ffd23e
SHA512ecf96eec09de05754c7f9bc06151507f92ef4bc106b024023cb7f3fec6ab5a2cf4bc792ce8efa302d193ce108fd96973de411900f4c15eafb8fbba4b611bc784
-
Filesize
5.0MB
MD5777cf4f784f298a3176566de29d99270
SHA18bd0c3ec9c850cd4ce5ba7f8d60bc3c6fc1756b2
SHA256fb2fe8a7ee7b818e9964fced715ff8a6757559d190d1ff2b81c071f823d1c0b9
SHA5121b897397a8222cb8d6aac9392274f48a4242f5251955efe4d95dfabd2680c1a5e33d10b972c5491cf131f38ffeebac608fd3d55054c160a30716547f2e6e110f
-
Filesize
5.0MB
MD56da5de40c9cd4f83a2eee2483fb2c048
SHA15868ff2850e13031a3652151b2bd1bfe5605d029
SHA2569d9c3b58cacb2af47ef6b22572106ca3742c1fa35f60a2a00052e21f7b249d8e
SHA5122771d7f54941a4dda220aa343c33ac0df5692e1d238562eee60618f64cb68008dfcf3de9e79704b8362feb4dc40dd28c840495ca9b1de89d4f163901130a5f2c