General

  • Target

    Blue Voice Changer_2.2.0.apk

  • Size

    16.1MB

  • Sample

    230114-r7aezshd82

  • MD5

    867f76dd1c40b6f067999a93262c5463

  • SHA1

    ab3b34124446b130e913b2912a6c87bf6c501b63

  • SHA256

    a2dd281e80ad605460221a27ac2d9a0b179f9ad68a370f15feeeeb3f983c4dd2

  • SHA512

    0941c84452712575aa98ade16cea0d7b66b235e55e4af4e290573511d2b8743b88636c3d6d847c6742bed656af167763dbf30f9ab69413e6b56dae8ecfcc5950

  • SSDEEP

    393216:dSKP32Yk6XMRy+IJjSmpu7q7NdhnJ/tgRz9UFI1U60:YKPTDXMRykeuW7Vfg59UFI1y

Malware Config

Extracted

Family

harly

C2

https://log.gfduytsdf.shop

Targets

    • Target

      Blue Voice Changer_2.2.0.apk

    • Size

      16.1MB

    • MD5

      867f76dd1c40b6f067999a93262c5463

    • SHA1

      ab3b34124446b130e913b2912a6c87bf6c501b63

    • SHA256

      a2dd281e80ad605460221a27ac2d9a0b179f9ad68a370f15feeeeb3f983c4dd2

    • SHA512

      0941c84452712575aa98ade16cea0d7b66b235e55e4af4e290573511d2b8743b88636c3d6d847c6742bed656af167763dbf30f9ab69413e6b56dae8ecfcc5950

    • SSDEEP

      393216:dSKP32Yk6XMRy+IJjSmpu7q7NdhnJ/tgRz9UFI1U60:YKPTDXMRykeuW7Vfg59UFI1y

    • Harly

      Harly is an Android trojan subscriber first seen in September 2022.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks