Analysis
- max time kernel
4167525s - max time network
132s - platform
android_x64 - resource
android-x64-arm64-20220823-en - resource tags
- submitted
07/05/2023, 09:14
General
- Target PosteID.apk
- Size 1.7MB
- Sample230507-k7c3jsdf37
- SHA256 03933fedda0104be2fdfc26a8f205657989b7e12a5446b2e754562a4abccd956
Score
10/10
Malware Config
Extracted
Family
-
hydra
C2
-
http://www.firrpxxxcjnnskk.xyz
Signatures
- Hydra
Android banker and info stealer.
- Makes use of the framework's Accessibility service. 2 IoCs
- Requests enabling of the accessibility settings. 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Reads information about phone network operator.
Processes
-
com.sdktools.android1⤵
- Makes use of the framework's Accessibility service.
- Requests enabling of the accessibility settings.