General

  • Target

    Nice Translationis_1.1.23.apk

  • Size

    15.2MB

  • Sample

    221205-nhrq7aeb23

  • MD5

    38ff6a4947dca0b9a58c9f0ff311539d

  • SHA1

    4a6a93953dbd0177a0d7d74af54fe32f78302dbe

  • SHA256

    8aa8a1f1aefe49e6ecb2ceeceeb240ec377d00a541c9893871dea2fa04de0c94

  • SHA512

    7155cf58d498d2ea3730a92348c0a3150f30cf151048bd9bc54ff99acc17844ad01862c082f8f5a3323a85d3d38b1d9db72546028701e91eaff40db58dd5ee17

  • SSDEEP

    393216:9PSMyDqUZgy5p/1lvar/fhmoZzgC76ZAoFSc+XMb:9PSvOUtlST4e76wh8b

Malware Config

Extracted

Family

harly

C2

https://api.metakamera.com

Targets

    • Target

      Nice Translationis_1.1.23.apk

    • Size

      15.2MB

    • MD5

      38ff6a4947dca0b9a58c9f0ff311539d

    • SHA1

      4a6a93953dbd0177a0d7d74af54fe32f78302dbe

    • SHA256

      8aa8a1f1aefe49e6ecb2ceeceeb240ec377d00a541c9893871dea2fa04de0c94

    • SHA512

      7155cf58d498d2ea3730a92348c0a3150f30cf151048bd9bc54ff99acc17844ad01862c082f8f5a3323a85d3d38b1d9db72546028701e91eaff40db58dd5ee17

    • SSDEEP

      393216:9PSMyDqUZgy5p/1lvar/fhmoZzgC76ZAoFSc+XMb:9PSvOUtlST4e76wh8b

    • Harly

      Harly is an Android trojan subscriber first seen in September 2022.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks