General

  • Target

    7483f5cc6b0e5630f18dba01f5a810d0

  • Size

    2.1MB

  • Sample

    220830-tkrf4ache8

  • MD5

    7483f5cc6b0e5630f18dba01f5a810d0

  • SHA1

    b86ff064886ebe04463bcdda11e0e3e3fce6eab6

  • SHA256

    0b7938b3d1c0163085aac6ab5434230e5a6473ef50fb550ce0fdaee35361fe89

  • SHA512

    7d1003dc9877f4926338f197927140824da3d866fb28924f646a5ab0538e69014c29981c7c51e2a9ae4c5cd61e5d9f162a20c2b7bdbb3967f837ab8fd0f7e682

  • SSDEEP

    49152:utTmFjrcfkEqAoXLWQXvblPYHLKojWX2GlXysS4cKdL:GT4cMEmXL3l8jyX1XS4c+

Malware Config

Extracted

Family

hydra

C2

https://notpro.top

Targets

    • Target

      7483f5cc6b0e5630f18dba01f5a810d0

    • Size

      2.1MB

    • MD5

      7483f5cc6b0e5630f18dba01f5a810d0

    • SHA1

      b86ff064886ebe04463bcdda11e0e3e3fce6eab6

    • SHA256

      0b7938b3d1c0163085aac6ab5434230e5a6473ef50fb550ce0fdaee35361fe89

    • SHA512

      7d1003dc9877f4926338f197927140824da3d866fb28924f646a5ab0538e69014c29981c7c51e2a9ae4c5cd61e5d9f162a20c2b7bdbb3967f837ab8fd0f7e682

    • SSDEEP

      49152:utTmFjrcfkEqAoXLWQXvblPYHLKojWX2GlXysS4cKdL:GT4cMEmXL3l8jyX1XS4c+

    • Hydra

      Android banker and info stealer.

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks