General

  • Target

    Super voice changer_1.42.apk

  • Size

    28.7MB

  • Sample

    230213-njp9racc8v

  • MD5

    244f46780caa83b92f7379239599440f

  • SHA1

    a4b8a6ff8ef0aeceac679a4da652b04d1ff3f033

  • SHA256

    35925c5b668193111bc08f3304dcf6fc92841102f311abfdcef6117bf817d4d8

  • SHA512

    ec7b14907aed7db5ce8f4b3b06d66bb6cd1724a5913489e5e04649838729811a168c5af2f5a34060c38aecd76e4dc03a0592ba8f5080051371064b6ea1afb960

  • SSDEEP

    786432:wEQD/mOkszUaHY+xLtGbge6kEZtbnaXJX2B:hYmGzUiY+xxvPDFa5mB

Malware Config

Extracted

Family

harly

C2

https://api.metakamera.com

Targets

    • Target

      Super voice changer_1.42.apk

    • Size

      28.7MB

    • MD5

      244f46780caa83b92f7379239599440f

    • SHA1

      a4b8a6ff8ef0aeceac679a4da652b04d1ff3f033

    • SHA256

      35925c5b668193111bc08f3304dcf6fc92841102f311abfdcef6117bf817d4d8

    • SHA512

      ec7b14907aed7db5ce8f4b3b06d66bb6cd1724a5913489e5e04649838729811a168c5af2f5a34060c38aecd76e4dc03a0592ba8f5080051371064b6ea1afb960

    • SSDEEP

      786432:wEQD/mOkszUaHY+xLtGbge6kEZtbnaXJX2B:hYmGzUiY+xxvPDFa5mB

    • Harly

      Harly is an Android trojan subscriber first seen in September 2022.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks