Analysis

  • max time kernel
    2682203s
  • max time network
    144s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220621-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
  • submitted
    15-08-2022 04:57

General

  • Target

    Google_Play_Store.apk

  • Size

    2.2MB

  • MD5

    40fc97a5fe3be6cb3879392881ca8b62

  • SHA1

    2f311abbfb0803d5ab36d4b77029c277edcc86c2

  • SHA256

    9501e061fb8c1b44a3733b3bab0c13429346b449c721792a41accfacccbd5dd2

  • SHA512

    36428b4ef6a661b74333f103c5fa73bd318808b06731a892bbf6b09b0f775a8db74e12dd184e2e8e1b96f54602779c27343d6bc50c3c31b29733ef22c3369ccc

Malware Config

Extracted

Family

hydra

C2

http://hagkokyogedses.net

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra payload 1 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.profit.fit
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:5034

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.profit.fit/app_DynamicOptDex/bdqh.json

    Filesize

    1.3MB

    MD5

    3c93277cefb9ff1f6a3c40d54a0c82d0

    SHA1

    20ecce7d3373b088a6eeb181a93a0a7c1a124706

    SHA256

    65d3f82393cbfbda8d17c73271f6a6cc549ec840b7c378cee279445e22e3fa60

    SHA512

    8a559252d7286097952269e8dc98594e3e1a8f0ade40a3e2fd230dae18916c118df20d9c540ae83e451160234529d0702b9906eb3dbfbf4f2e64ebfee9f6c1a3

  • /data/user/0/com.profit.fit/app_DynamicOptDex/bdqh.json

    Filesize

    3.6MB

    MD5

    f6dc9780d31f7ccdb87a4af68ea43e14

    SHA1

    4d94f0ebc04842f085befd4c49c6ad35cf7bed9f

    SHA256

    e073d87e9764b53c3106d029c19f5ae8be790a0567b88e349c057bb6f011d944

    SHA512

    f1b208827276a9c87a6ab7ff2f34da5b6ab3e1553fefa89762c1abfcdef2c50bd35e69bacc0062fec234269cddfe4d849b6e01f34463bfec71a0c61e456f6e24

  • /data/user/0/com.profit.fit/app_apk/payload.apk

    Filesize

    974KB

    MD5

    3baeaa766ea7f31a9147208efd957c75

    SHA1

    c701de3d0e55425394ccbf8e0967639e86f3c54e

    SHA256

    75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

    SHA512

    9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f