General

  • Target

    5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f.apk

  • Size

    2.5MB

  • Sample

    220916-n8sq6sbdep

  • MD5

    9dce53cc6e6b6dac4fb6809c91dfc65a

  • SHA1

    cc0b6bb5f40418f8c8acfd76c2c257a386820a27

  • SHA256

    5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f

  • SHA512

    9ad44686ecb65fb205b9854b5870474b3dbb544b5e186bc092c2b0e9bb603f473ba24d59eca07c9da95bf335524e3a5320ef9ef2949729dfd0a7b6889e4979e8

  • SSDEEP

    49152:yczkN3OFFeI5f+bByP3p0vTx6PrSeojWfTp7e4GgBgl1thgg2wSiID3Kv8g8Cdu3:VtFFeWfmB0ZI6TD7p7Gggf2wnID388oI

Malware Config

Extracted

Family

hydra

C2

http://kartofcar.com

Targets

    • Target

      5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f.apk

    • Size

      2.5MB

    • MD5

      9dce53cc6e6b6dac4fb6809c91dfc65a

    • SHA1

      cc0b6bb5f40418f8c8acfd76c2c257a386820a27

    • SHA256

      5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f

    • SHA512

      9ad44686ecb65fb205b9854b5870474b3dbb544b5e186bc092c2b0e9bb603f473ba24d59eca07c9da95bf335524e3a5320ef9ef2949729dfd0a7b6889e4979e8

    • SSDEEP

      49152:yczkN3OFFeI5f+bByP3p0vTx6PrSeojWfTp7e4GgBgl1thgg2wSiID3Kv8g8Cdu3:VtFFeWfmB0ZI6TD7p7Gggf2wnID388oI

    • Hydra

      Android banker and info stealer.

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks