General

  • Target

    Google_Play_Store.apk

  • Size

    3.1MB

  • Sample

    221118-h7f34agh33

  • MD5

    06cf10298c93ba089b7d6ff8dc83fdb1

  • SHA1

    75bfb5c86bed1e4fa431620163b1707e0645b083

  • SHA256

    75b693bb2da7c3c94ceb07b88ff9bee0dccaad15425e56344e415addbcf3737c

  • SHA512

    2d4508e8d563351ac1699f776b2e632cbfc5f6e967fa1a1a05b9d4098eb3a3b7e7d83400032bb44f0cc1144da1e0e1c1881e249bea9eda0ffece0d3edc7c1bb9

  • SSDEEP

    98304:UvLCmQAVcZff+/baymELAkyzjh4GwnO3WDWMgk:UumQ2cZfG/baymiAkyzj7wnOG5gk

Malware Config

Extracted

Family

hydra

C2

http://aykomediki.net

Targets

    • Target

      Google_Play_Store.apk

    • Size

      3.1MB

    • MD5

      06cf10298c93ba089b7d6ff8dc83fdb1

    • SHA1

      75bfb5c86bed1e4fa431620163b1707e0645b083

    • SHA256

      75b693bb2da7c3c94ceb07b88ff9bee0dccaad15425e56344e415addbcf3737c

    • SHA512

      2d4508e8d563351ac1699f776b2e632cbfc5f6e967fa1a1a05b9d4098eb3a3b7e7d83400032bb44f0cc1144da1e0e1c1881e249bea9eda0ffece0d3edc7c1bb9

    • SSDEEP

      98304:UvLCmQAVcZff+/baymELAkyzjh4GwnO3WDWMgk:UumQ2cZfG/baymiAkyzj7wnOG5gk

    • Hydra

      Android banker and info stealer.

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks