Analysis
-
max time kernel
2682203s -
max time network
144s -
platform
android_x64 -
resource
android-x64-arm64-20220621-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system -
submitted
15-08-2022 04:57
Static task
static1
Behavioral task
behavioral1
Sample
Google_Play_Store.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral2
Sample
Google_Play_Store.apk
Resource
android-x64-20220621-en
Behavioral task
behavioral3
Sample
Google_Play_Store.apk
Resource
android-x64-arm64-20220621-en
General
-
Target
Google_Play_Store.apk
-
Size
2.2MB
-
MD5
40fc97a5fe3be6cb3879392881ca8b62
-
SHA1
2f311abbfb0803d5ab36d4b77029c277edcc86c2
-
SHA256
9501e061fb8c1b44a3733b3bab0c13429346b449c721792a41accfacccbd5dd2
-
SHA512
36428b4ef6a661b74333f103c5fa73bd318808b06731a892bbf6b09b0f775a8db74e12dd184e2e8e1b96f54602779c27343d6bc50c3c31b29733ef22c3369ccc
Malware Config
Extracted
hydra
http://hagkokyogedses.net
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
resource yara_rule behavioral3/memory/5034-0.dex family_hydra -
Makes use of the framework's Accessibility service. 3 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.profit.fit Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.profit.fit Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.profit.fit -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.profit.fit/app_DynamicOptDex/bdqh.json 5034 com.profit.fit
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD53c93277cefb9ff1f6a3c40d54a0c82d0
SHA120ecce7d3373b088a6eeb181a93a0a7c1a124706
SHA25665d3f82393cbfbda8d17c73271f6a6cc549ec840b7c378cee279445e22e3fa60
SHA5128a559252d7286097952269e8dc98594e3e1a8f0ade40a3e2fd230dae18916c118df20d9c540ae83e451160234529d0702b9906eb3dbfbf4f2e64ebfee9f6c1a3
-
Filesize
3.6MB
MD5f6dc9780d31f7ccdb87a4af68ea43e14
SHA14d94f0ebc04842f085befd4c49c6ad35cf7bed9f
SHA256e073d87e9764b53c3106d029c19f5ae8be790a0567b88e349c057bb6f011d944
SHA512f1b208827276a9c87a6ab7ff2f34da5b6ab3e1553fefa89762c1abfcdef2c50bd35e69bacc0062fec234269cddfe4d849b6e01f34463bfec71a0c61e456f6e24
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f