Overview

overview

10

Static

static

7

981c18b7fe...a2.apk

android-9-x86

10

981c18b7fe...a2.apk

android-10-x64

10

981c18b7fe...a2.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    981c18b7fe8f0e47a5e5f1e67b8a66a2.apk

  • Size

    2.4MB

  • Sample

    221102-ezwl2ahcd7

  • MD5

    981c18b7fe8f0e47a5e5f1e67b8a66a2

  • SHA1

    3c26529c09a2cf168d22ac1cad88b55c1e515113

  • SHA256

    d105764cd5383acacd463517691a0a7578847a8174664fc2c1da5efd8a30719d

  • SHA512

    438e0bc868742d534f6504e4b4860afe63f0012c99dcf41cd6b2fdde88a3ed835f101d71c65bc3bd61696cb8b9dbea657042794c492dfbc6eee1ab3876ae6039

  • SSDEEP

    49152:yekGLrMrdYCdA/nVB83w4lnntA2ZGM2FtfiMbMlIAHhROmynu:yekGLrOdAPb83w4mM+DQiAhROmwu

Score
10/10
hydraandroidbankerinfostealertrojan

Malware Config

Targets

    • Target

      981c18b7fe8f0e47a5e5f1e67b8a66a2.apk

    • Size

      2.4MB

    • MD5

      981c18b7fe8f0e47a5e5f1e67b8a66a2

    • SHA1

      3c26529c09a2cf168d22ac1cad88b55c1e515113

    • SHA256

      d105764cd5383acacd463517691a0a7578847a8174664fc2c1da5efd8a30719d

    • SHA512

      438e0bc868742d534f6504e4b4860afe63f0012c99dcf41cd6b2fdde88a3ed835f101d71c65bc3bd61696cb8b9dbea657042794c492dfbc6eee1ab3876ae6039

    • SSDEEP

      49152:yekGLrMrdYCdA/nVB83w4lnntA2ZGM2FtfiMbMlIAHhROmynu:yekGLrOdAPb83w4mM+DQiAhROmwu

    Score
    10/10
    hydrabankerinfostealertrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks