Overview

overview

10

Static

static

7

Google_Play_Store.apk

android-9-x86

10

Google_Play_Store.apk

android-10-x64

10

Google_Play_Store.apk

android-11-x64

10

Analysis

  • max time kernel
    2840820s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    13-01-2023 04:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Google_Play_Store.apk

  • Size

    3.1MB

  • MD5

    06cf10298c93ba089b7d6ff8dc83fdb1

  • SHA1

    75bfb5c86bed1e4fa431620163b1707e0645b083

  • SHA256

    75b693bb2da7c3c94ceb07b88ff9bee0dccaad15425e56344e415addbcf3737c

  • SHA512

    2d4508e8d563351ac1699f776b2e632cbfc5f6e967fa1a1a05b9d4098eb3a3b7e7d83400032bb44f0cc1144da1e0e1c1881e249bea9eda0ffece0d3edc7c1bb9

  • SSDEEP

    98304:UvLCmQAVcZff+/baymELAkyzjh4GwnO3WDWMgk:UumQ2cZfG/baymiAkyzj7wnOG5gk

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

http://aykomediki.net

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.wagon.track
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    PID:4604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.wagon.track/app_DynamicOptDex/OdyqAaN.json
    Filesize

    1.6MB

    MD5

    281bbe18016d45aa9798a7fd3d4700f6

    SHA1

    0b342c1a181b9acaa009b0ef8220396d4cef89f3

    SHA256

    1ad48872e0643b81541465070ee063aa115bf6fed538e252f745ae34f574b41b

    SHA512

    600e0a742b475b1ec93095e126befb920a490f90bce605114aea7c11d91a0c4b6a18dfe4a9fe83a5fb8da800bbfec0ca33732e9ce4a4dc5bb9718e57271049ba

    Download Submit
  • /data/user/0/com.wagon.track/app_DynamicOptDex/OdyqAaN.json
    Filesize

    4.4MB

    MD5

    5e778fa1b19c3d2f83f4547f9eb1fe3c

    SHA1

    bbeef5360c21685137d05c1a3eadbdf6626eb75a

    SHA256

    cda6b26aa4a8bf4d97933d4cb7d1caf1b537ac2539ed399925927b467fcb29e5

    SHA512

    d5c703400e1d182f7c5a8f575a27b30ed0afdc8029d148700101dc890ea97b683471280f68e9b46462b48b28653486de8bd615cecf7cd67d81df2c8e605fca9f

    Download Submit
  • /data/user/0/com.wagon.track/app_DynamicOptDex/oat/OdyqAaN.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.wagon.track/shared_prefs/pref_name_setting.xml
    Filesize

    131B

    MD5

    1ffc24d72cedcb1c8293b75e897870c8

    SHA1

    e97a0b217d093ee4b23429389e80fe08365e8a9d

    SHA256

    d50b157a218e63261203005bc3d63dba2fc069d8fb86ad25d0cc0f2a4a32d863

    SHA512

    df53bdc2ef3d803f36d6f48e17fc9571e535e2c5dffb4dce418ecc9b844b6735014af8c58d1305b3423718b5da7b3009d9c0754cf00850cb9adaa0435e881c16

    Download Submit