General

  • Target

    152c236f84d44d34c3d0c6a6450ed933893fb6ea274e5561157f8a92966c0448

  • Size

    3.2MB

  • Sample

    230124-f9qn7sgg69

  • MD5

    b5efac544d0252fa6e455623973d7785

  • SHA1

    a3be74cf193eabf31eb342a4c47349ff5d2ed98b

  • SHA256

    152c236f84d44d34c3d0c6a6450ed933893fb6ea274e5561157f8a92966c0448

  • SHA512

    d9da522ba1179750ed5168ba652f37d88a542b3241802e8817a8f9aee60e67c1d408dacace1e9c2eddeb4a0de9872b2ea20c4947817e884d1fd6dd14c50edd14

  • SSDEEP

    49152:dLkoqMI6jH8bN35czKUjMMC59xtoXJX5kdW2AL+pHqRzgmhRh5wSWh/DrYItwTG1:dL7qKjH8U+UjMd5y+7A0HN1h3nw+vTMs

Malware Config

Extracted

Family

hydra

C2

http://185.161.209.172

Targets

    • Target

      152c236f84d44d34c3d0c6a6450ed933893fb6ea274e5561157f8a92966c0448

    • Size

      3.2MB

    • MD5

      b5efac544d0252fa6e455623973d7785

    • SHA1

      a3be74cf193eabf31eb342a4c47349ff5d2ed98b

    • SHA256

      152c236f84d44d34c3d0c6a6450ed933893fb6ea274e5561157f8a92966c0448

    • SHA512

      d9da522ba1179750ed5168ba652f37d88a542b3241802e8817a8f9aee60e67c1d408dacace1e9c2eddeb4a0de9872b2ea20c4947817e884d1fd6dd14c50edd14

    • SSDEEP

      49152:dLkoqMI6jH8bN35czKUjMMC59xtoXJX5kdW2AL+pHqRzgmhRh5wSWh/DrYItwTG1:dL7qKjH8U+UjMd5y+7A0HN1h3nw+vTMs

    • Hydra

      Android banker and info stealer.

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks