Resubmissions

11-10-2022 13:32

221011-qs1sysgbdk 10

General

  • Target

    8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430.zip

  • Size

    2.8MB

  • Sample

    221011-qs1sysgbdk

  • MD5

    d5ca4f8fd5727db816a76cddeb98dc88

  • SHA1

    9bf1dd2579cbab15865f357b81c23421d62907b6

  • SHA256

    3df6e6f451c46ed9d8d88e223a0baffea4da07abfe0258b107aa22c2f0f4e6ed

  • SHA512

    74f4a749b7238fb94f5f0a1c4730269a56db23d4183ad10b945f21f8c488b77843902ceff5d0609ea2d53a79e7ac76121d61a9c49bd5dd171da43bc1a219640d

  • SSDEEP

    49152:FhOin4r4IwNviBHi4S20xLupOFjL8IE0afA4j3hC2DjlDk+FAIUjkqfarYWB7UqA:Fhd4UKbS20xhJL8INa4K3ZXdk+yIUjLP

Malware Config

Extracted

Family

hydra

C2

http://lalabanda.com

Targets

    • Target

      8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430.apk

    • Size

      2.8MB

    • MD5

      d1a68785559ae6b0049a2bd1798277a1

    • SHA1

      8ea0706e77e57810ff1bc9073f3701772f032557

    • SHA256

      8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430

    • SHA512

      b4c676c19dedf7b582598bc8bc9d3bf260b3847564d7da755cf9e694abdf2ad3555da526b7ff847dcbddf75b9d1183924a29078d181b313fcec18c8b5349637a

    • SSDEEP

      49152:Ucz4N3omNn0M+CGN3SPXLD8S/obeUQGkfC1T3Eb0KizuNAGq6BXk2M:LrmR0vCSC/robeZGkfk0xA1XX

    • Hydra

      Android banker and info stealer.

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks