Overview

overview

10

Static

static

7

CoinbaseUp...14.apk

android-9-x86

10

CoinbaseUp...14.apk

android-10-x64

10

CoinbaseUp...14.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CoinbaseUpdate20.14.apk

  • Size

    2.8MB

  • Sample

    220921-k7cf1sfhf8

  • MD5

    4a221804f5dec022c97fb357a9cfaef3

  • SHA1

    d7ed8ef2bcfdd0a4d9dd80a55180cf24240a3121

  • SHA256

    eb2f45849072ef2f4d638ce47b4f5a7b277c4569896f756a1bdc69d519530f79

  • SHA512

    8669b638ace30100ab920940d2773248f2d557be993bfc75be21e473835f1027924c103ab36847d2d66337008534f18c539cdb3a32ab36324852300b3120480e

  • SSDEEP

    49152:gczMN3P6UMvE2d8J+qE2WsSYuy3raEasn5KXyG7TLoGDtcX7LprG9:3Y6U8E2dgXE2mYuy3Hasn8XyGHLooars

Score
10/10
hydraandroidbankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

http://lalabanda.com

Targets

    • Target

      CoinbaseUpdate20.14.apk

    • Size

      2.8MB

    • MD5

      4a221804f5dec022c97fb357a9cfaef3

    • SHA1

      d7ed8ef2bcfdd0a4d9dd80a55180cf24240a3121

    • SHA256

      eb2f45849072ef2f4d638ce47b4f5a7b277c4569896f756a1bdc69d519530f79

    • SHA512

      8669b638ace30100ab920940d2773248f2d557be993bfc75be21e473835f1027924c103ab36847d2d66337008534f18c539cdb3a32ab36324852300b3120480e

    • SSDEEP

      49152:gczMN3P6UMvE2d8J+qE2WsSYuy3raEasn5KXyG7TLoGDtcX7LprG9:3Y6U8E2dgXE2mYuy3Hasn8XyGHLooars

    Score
    10/10
    hydrabankerinfostealertrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks