General

  • Target

    Bee Translation_1.0.6.apk

  • Size

    19.9MB

  • Sample

    230206-relybahe4v

  • MD5

    3689691b61e61c3b2f7a0c846a9f640c

  • SHA1

    f1a284e403ff3211220835bec4287c9cf9c2e70e

  • SHA256

    ce2e3e419f537f23e39843433e37559230926fee3fea54415552e8d061f57edf

  • SHA512

    87c33858ae53108e4594abf68ea98dacee98196504f34ac81ff64ade17331b4bc6254c7312e6d10c9046363683ac14a1cf2bc826b7f6db24059c1f228b5b7b10

  • SSDEEP

    393216:LSKP32yCWFPsPv4HxYIMEi9Wgl9W+YfazDIVD6bcAv6J+4TTPm:+KP3fBQIs8+YfqDyDUGm

Malware Config

Extracted

Family

harly

C2

https://fox.gvbkopdf.life

Targets

    • Target

      Bee Translation_1.0.6.apk

    • Size

      19.9MB

    • MD5

      3689691b61e61c3b2f7a0c846a9f640c

    • SHA1

      f1a284e403ff3211220835bec4287c9cf9c2e70e

    • SHA256

      ce2e3e419f537f23e39843433e37559230926fee3fea54415552e8d061f57edf

    • SHA512

      87c33858ae53108e4594abf68ea98dacee98196504f34ac81ff64ade17331b4bc6254c7312e6d10c9046363683ac14a1cf2bc826b7f6db24059c1f228b5b7b10

    • SSDEEP

      393216:LSKP32yCWFPsPv4HxYIMEi9Wgl9W+YfazDIVD6bcAv6J+4TTPm:+KP3fBQIs8+YfqDyDUGm

    • Harly

      Harly is an Android trojan subscriber first seen in September 2022.

    • Acquires the wake lock.

    • Checks Android system properties for emulator presence.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks