General

  • Target

    Good Launcher - Live Wallpaper_1.1.1.apk

  • Size

    21.7MB

  • Sample

    221016-kzprdahbg3

  • MD5

    d7ffbdf8e491f0c3e53901cf830f10b2

  • SHA1

    5c8b3e868fa848b63a04df230a7760f570e9f439

  • SHA256

    ec1688500c94d59afa764dcfd1690a4b2e4f4a4520bb04e5e147f8ce05158d7b

  • SHA512

    0f8c33bc31ae95cede1d1154a028fa13f50f10869f60b804794b441a37234bc2e7220a2dc9f82c2786ee393b491b1d6bbd254bd2930fe0c77b7e781641f31096

  • SSDEEP

    393216:v4rHr7amK5zj/WorwB6qCkA2nsjTTgAuVMCOhNgu3FBPb4nievYFXIwq:v4rHrfy//dbFwsjT0AvnOrQ8

Malware Config

Extracted

Family

harly

C2

https://admin.keyseotyn.online

Targets

    • Target

      Good Launcher - Live Wallpaper_1.1.1.apk

    • Size

      21.7MB

    • MD5

      d7ffbdf8e491f0c3e53901cf830f10b2

    • SHA1

      5c8b3e868fa848b63a04df230a7760f570e9f439

    • SHA256

      ec1688500c94d59afa764dcfd1690a4b2e4f4a4520bb04e5e147f8ce05158d7b

    • SHA512

      0f8c33bc31ae95cede1d1154a028fa13f50f10869f60b804794b441a37234bc2e7220a2dc9f82c2786ee393b491b1d6bbd254bd2930fe0c77b7e781641f31096

    • SSDEEP

      393216:v4rHr7amK5zj/WorwB6qCkA2nsjTTgAuVMCOhNgu3FBPb4nievYFXIwq:v4rHrfy//dbFwsjT0AvnOrQ8

    • Harly

      Harly is an Android trojan subscriber first seen in September 2022.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks