General

  • Target

    8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430.apk

  • Size

    2.8MB

  • Sample

    230529-mbc4sabc62

  • MD5

    d1a68785559ae6b0049a2bd1798277a1

  • SHA1

    8ea0706e77e57810ff1bc9073f3701772f032557

  • SHA256

    8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430

  • SHA512

    b4c676c19dedf7b582598bc8bc9d3bf260b3847564d7da755cf9e694abdf2ad3555da526b7ff847dcbddf75b9d1183924a29078d181b313fcec18c8b5349637a

  • SSDEEP

    49152:Ucz4N3omNn0M+CGN3SPXLD8S/obeUQGkfC1T3Eb0KizuNAGq6BXk2M:LrmR0vCSC/robeZGkfk0xA1XX

Malware Config

Extracted

Family

hydra

C2

http://lalabanda.com

Targets

    • Target

      8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430.apk

    • Size

      2.8MB

    • MD5

      d1a68785559ae6b0049a2bd1798277a1

    • SHA1

      8ea0706e77e57810ff1bc9073f3701772f032557

    • SHA256

      8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430

    • SHA512

      b4c676c19dedf7b582598bc8bc9d3bf260b3847564d7da755cf9e694abdf2ad3555da526b7ff847dcbddf75b9d1183924a29078d181b313fcec18c8b5349637a

    • SSDEEP

      49152:Ucz4N3omNn0M+CGN3SPXLD8S/obeUQGkfC1T3Eb0KizuNAGq6BXk2M:LrmR0vCSC/robeZGkfk0xA1XX

    • Hydra

      Android banker and info stealer.

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    • Target

      callout_7_overlay.svg

    • Size

      1KB

    • MD5

      13da4f83c32b6af839f40448ad4093dd

    • SHA1

      2dd817cbb6c2198c9b622bf8a4a4bd0f58c5980d

    • SHA256

      22a5b339c8e15d0b1393e540966b414ca577f1e6c2c4682bef22e98f74e5a5d3

    • SHA512

      3c5e37b7638099495ca3773edd1b4c780ceced0db68749c7c7437ad460ae765f1e3f952e146f7851a778f9dd32a5c7cce57ee616c0f015231b0071c9a39013cb

    Score
    1/10
    • Target

      callout_8_overlay.svg

    • Size

      2KB

    • MD5

      65a2809f038ffa4146cf59a57e6bb32d

    • SHA1

      3b5e30bf5de229cbeb085e1ea355288d63ebea51

    • SHA256

      8dc35b01684c284e85275509e698edea94e73f6e328732993a96b881f20eaaff

    • SHA512

      2f792059b6aa0a1dd32924169fb9176e9c6523c6f17b17cbaa2486bb246b6f726e01717b47372d9558501cb2dc5f51c1564b7ce195bcde1769e07b3fb8a7879b

    Score
    1/10
    • Target

      callout_cloud.svg

    • Size

      4KB

    • MD5

      cd47d4b3192545c91fdddeae5adb3d8a

    • SHA1

      8d389882bb4a501bd8d2c9690a023d0c808213d7

    • SHA256

      8ec8ca9e56edab13c9b45aa0dc21a4970398ba6917efb981e4533cd510c56d58

    • SHA512

      58f8482402652807229c3d5a563c785f4f85d6f768592521b951ade7555826f49f45e41881b1012c0350ee5aa77e0e4daa22f207e0fa3ddf3f06c16e49817ddc

    • SSDEEP

      96:7OKfETG9jU7aGyVS0/K4TL+uhBj0HPDYKnCZB4qdP9:SoZuaGyg01TPhUzMd1

    Score
    1/10
    • Target

      callout_dest_bubble.svg

    • Size

      1KB

    • MD5

      5a1b792bf859e656807fb87228b66416

    • SHA1

      21612430725df233bd8bd7e10ae17a33a7923429

    • SHA256

      07c9841559f933977b9448e4ed5e18e3000666faa8768526136bccebefe8b104

    • SHA512

      e908a8dd836b51193f62b60eda3a5371cb9f2548e0b792e90fe624e012c7d64c20c987ead14f591a1e59b7786eec31221f56148447ba8deb53082c7594462b25

    Score
    1/10
    • Target

      callout_shape_2.svg

    • Size

      4KB

    • MD5

      6dc1e0aa43dd2a582b24b6487605fb76

    • SHA1

      c403b4c464908b8d740d03775742fdc72a6e8327

    • SHA256

      f6ec4c71c9e3ebfc1d23691364cc5736a12c3180ad35e55f4f9dc0fa3ce03669

    • SHA512

      3cced4fb52552f26f35eac6eacf8fc408b6f5e251984f486e203777b0889261db83ea127a97b5e53c246456c819b23b6d6209fec1bb3a6df5f173e66de370ce2

    • SSDEEP

      96:7OKfvMkrs4v9rTicBaUTnpI5kS0nvVfiYPl9Cb7dMM/SAWicJPjiBwlH:SoT44Vp3hrnvVqY99CR/SAWicgwN

    Score
    1/10
    • Target

      callout_shape_4.svg

    • Size

      1KB

    • MD5

      828a7ba18fb29733210cccea82833faf

    • SHA1

      0eab9f3bb7bb221a0d54a0da3379edfa80a713ed

    • SHA256

      fad97a809483b5b59a783e811aea993048047ae6efee1f861233a63067b7a815

    • SHA512

      ee5fea4dce25d0bc8ea471641e4bfaa3da2305b9be2c494ae8f444e44c65494764180b5412fa7192198280b2aff420c2a76eda41f036ee87a9eb246d2a067944

    Score
    1/10
    • Target

      callout_shape_5.svg

    • Size

      3KB

    • MD5

      3b6eb1ca75da44d8df15f66358aa7ed2

    • SHA1

      6e43efdc6bb028ca022a2bc8bb005ad4f52f0d08

    • SHA256

      dbac2601ec9c8909b1af9992c835313f62d2f6f8226e3e142136c8e3fa793f0a

    • SHA512

      08f6e115d5b32e7d6c305be446f4ca9f803031486c6816a50ee981ab68f0d588247dc22f8048881e2319fcad2c935d1fcb2c25560a8a79a5500a97bf68963970

    Score
    1/10
    • Target

      callout_shape_6.svg

    • Size

      795B

    • MD5

      05756dcdfc425a86b875a296518e5e7b

    • SHA1

      f672a1e93bfc33b727a0d453ef66a530dad0de6f

    • SHA256

      314286468da8ded2d9baf6c2f6c172ae3926024d60efa1b4c2aa22b0155062c2

    • SHA512

      b19f29e3265f3198037ad6e3d5cbda6d3bf9856df9f76553c83e057c0ce5e5e22848fb264c09fb270762bbf1b97efbfef57e7fcded5cc4e55bb654657389a2e0

    Score
    1/10
    • Target

      core_wrapper.js

    • Size

      5KB

    • MD5

      2558e92bdb03c3e4685d4320a7cbe715

    • SHA1

      9feff7ec75024ba6d9753ea233ffbe0b7bc04bf7

    • SHA256

      99a17d18531953e748103eb021738a42eb9fe675532a4d42441d3bc34e048bc8

    • SHA512

      83409561241255be24558f6b238f1687ea7f703d6950a8ad54ff4c50aa9c62af490b74e9b60379ff074b92942bf4752a653a19c4da2b554ac59ecfa0f5fad9f3

    • SSDEEP

      96:MIn5NKjaILnYJX+myXjfaw17BLyHjLAHIIJUU/AUYYg8InG+d:N5NKjDrYJX+my7aw17UHjLAHIIJUUAW8

    Score
    1/10
    • Target

      faq.html

    • Size

      6KB

    • MD5

      4f033fe746d505abfec1509cd2fe1f3d

    • SHA1

      e5500741109c4d1c98ed64487d14b7a44a2561a6

    • SHA256

      453aac1c4afe04028cf46d4ad48da0bf7e6877adb7b5bf3d40e81cfe11b566d7

    • SHA512

      32f01e9be7e7addd654719d950390c10a633bec8ac248360d3e4b8e121e86fb4de8c81a81d212474dd05ee67e1f5840a4dac8c031b6a39bdeb3260d089acb7cb

    • SSDEEP

      96:nncFbA5FdzBXUHcMiZmxDHkC5EX8cyqmriC5yEXEyQ6TL3RpF:nncFbWXUHl/xRov0EyX3N

    Score
    1/10
    • Target

      help.htm

    • Size

      53KB

    • MD5

      883888def347f0db8dbdec1fe82be5c9

    • SHA1

      f54280a3690f373a05cf438ca12c3e482bc1ed8a

    • SHA256

      766c2b736da4683d0f7cd5927cab1441dc13bca47af33b0911d5aaaa70da6ab2

    • SHA512

      4538af3b0b7b2786461d37ca6e3b93290ff9d6a6b7820f7dd3bf3840414c06e0c271786a91e5164d8767ecc66645f9a09599af661ddc39384717dbb80d9cc546

    • SSDEEP

      768:FWAtJoDQSUPSEXVe5wSsRz1K4I8Cnsro7:b6kxPSGowS+E4I8Wsa

    Score
    1/10
    • Target

      help_cs.htm

    • Size

      54KB

    • MD5

      22d33848ee6cae8aa8c1e90bdcd65226

    • SHA1

      982e9769391e13507289928289f11aa6e5b6c91b

    • SHA256

      b8a728e6bd697922bc23732cd444d25697d418ec6fd7a8cc322029cd71670148

    • SHA512

      25f1415f0b3e9c34fcd7f896b784d340622f74a7ff308c62da8961c1b7fa82f7ff038b54fed3d9a048a67039058d1c9f604f3be56f495288e417eacc034f7822

    • SSDEEP

      768:/3AjqEZHfLqlREwa3CL+9pcYX/wXBSBHz114I8h9KQc3G6mq/zAIjRK0:/4qC/KEwan7/wXBSlD4I8h9KQc3GX0

    Score
    1/10
    • Target

      help_de.htm

    • Size

      59KB

    • MD5

      52e18bac42fb06e4116cdaee988e0661

    • SHA1

      9d0ef32f76cab08d380ec1359e414fbbd1d207ae

    • SHA256

      54d12be384ad0a78c68a416873338edf8ceb5601a20895ca6aef9360b0cd75e8

    • SHA512

      8a2b4e11b1a368075b8871bf90517890c79dfa88ac2bc9b355af305fe134b6ec4c6d02a50d334ee3b734628f4a0f7df142fe30b5acbfd33abc9904cd48c485cb

    • SSDEEP

      768:cklY6UHcqSlF+xUVPB6rKboSNzCWidlub1uaablOEhEs8e2gcaUrF20OzGJPCGdC:AH7SlFs2Pam9idlub4los8e3ZUrgVETC

    Score
    1/10
    • Target

      help_es.htm

    • Size

      61KB

    • MD5

      31772dae5e7e480072ed6d872134201e

    • SHA1

      4c19adebf12a2aa4be9773ee4226fcbc79b89e84

    • SHA256

      f088fe7faadb088d3f63ad8f6d6eea2d88abf4e7318e31e17dbe52d5e4f92707

    • SHA512

      5f19c826336d100b5d104002eb0b35dbaf24889225630a3e9c31aeab3d77d912adaec0470d1d0fbd2e60956a11eaccbff385bd7d28ef8acf7dbccc9434fe8e2b

    • SSDEEP

      768:hLYLmYEm9UhhJ6TJ5w7NKVwvTAybuosWqPOg+YS3+brRzf:hlYjikW7NKVwbootYXfS3Sx

    Score
    1/10
    • Target

      help_ru.htm

    • Size

      58KB

    • MD5

      0b8a2f9f0fefa77f9b5e53371195d732

    • SHA1

      53cdd30958d2863ba976fa4e9e7ceabdd85ffb60

    • SHA256

      88212e9f4c88a33b0147f5aa5dd3f8fa434707b1b925e3d45fb03366e909ec5a

    • SHA512

      5b3f90561d9b819dcfa05ef463c2453786b7d4adddc9ea5d84b2b2ebc07106fd6aa3b906e04b386cda7103e22e10d5430e258983d2aaf8880c4230ef06894309

    • SSDEEP

      768:PRtY5bm3l9Q/DVcYRTI3n81skx61fJBwghQg:p+5C3l8Pu3n81sFBAg

    Score
    1/10
    • Target

      help_uk.htm

    • Size

      57KB

    • MD5

      6f351ddb8050526c77850db00448d3c8

    • SHA1

      dd253c3d52261d3504bfeadeee08266ab01da749

    • SHA256

      6bf22746ea6b58743544aeebb5f47fdc690e19037d4702926567a69ad426c463

    • SHA512

      e52e1b60b6866175249c33e5b72329c02d2a743673d6845d2ccc2051f4e77967367b095714c583d315ad03e849ab6877e958f6beb5314274e263bc03a8362551

    • SSDEEP

      768:m6At7jfON+B88ArRwU5XG0uUOBiKaBb4JKpBbZM5XyZwhDmILSsb:1UOnrRwtfiKaBb4WXMoaqI2sb

    Score
    1/10
    • Target

      i_message_1.svg

    • Size

      601B

    • MD5

      9abee6e4907f423296c10f21f595d3e8

    • SHA1

      32b881d71168f7f7d41eb5fafd41a8e8299d3126

    • SHA256

      fcef8e1f00beeb41f91d31384497f3b4fa1278f50507a9f03a0dc2d7ac9dcaec

    • SHA512

      069617f8d2368557d82d71cdbd6f25e8de43468dad2197a3553a9045e1ce91fe322c507482d337030f8f9da828b4d265a658127ee1cf3bc1250345bf3e7f211e

    Score
    1/10
    • Target

      i_message_2.svg

    • Size

      594B

    • MD5

      88ad40402cb70a318c55387af37d1bf4

    • SHA1

      ba8ceba14b21abf867753b7dc664e682c587354d

    • SHA256

      d6926ce6d048d2e4e4e8559b78d8d39ba03e8b5f48187ab0335f1c311a3ecaf6

    • SHA512

      59b9e5030b0c28776c9fd90a7ed0cdc10cf0693522282b42c4c2d09a7e6586bedadb8105b587283ab13940d5225d7be0976f7d3c3d37f62a8f92abe3be28ac3b

    Score
    1/10
    • Target

      i_message_3.svg

    • Size

      616B

    • MD5

      2cbfa1251a64251a684676e141474dc0

    • SHA1

      af2d0c7cc3c4130f1b00f69b16e23eae053b36e1

    • SHA256

      00f287ea80cb246f432967062310d6da0a9b83bcbed8b657dbcc8a73dd59f4e6

    • SHA512

      3b9a2ed2b182e442e80f07a524a0d3840ebcb4adc53a3de1a0137b284f87d904677f4b55d00219a62ad18ab540656d3d0c7389c450b1f93bdbbb50d363d528b1

    Score
    1/10
    • Target

      i_message_4.svg

    • Size

      604B

    • MD5

      8220f1d55ef7394ddaa3b4f514684831

    • SHA1

      db5d2d0f7b8d105353f7598d9cbe2c01e4862851

    • SHA256

      29762e9c53c4c901c76ba6ccda44a3953e98d220f095f66d11d157753a47087f

    • SHA512

      643433437b7f7eadd8dbfd7c9810db0d5d7e0538475f4191acaa93efcd2e4297a4c8bea4b1eb99152f5845ca41c510ab91a1c36100aee0cb6e8960413aef9c3e

    Score
    1/10
    • Target

      license.htm

    • Size

      6KB

    • MD5

      407f13382c8d7a039a9eaef44f79642e

    • SHA1

      d16f70c6d1703efc33823ab385ceabd8447ac1bc

    • SHA256

      657c157f78e360d37e2485f6245b4f87789ece5a2b150a4f4fe9fead0c6facd3

    • SHA512

      213e32e5f04199153ad3702e8706b0399fdb8c683a47dfbde7dce8a91ef7786c7d43830eeaf5d03fade136a74ca0908eabd797be806d15c106a2e070579ada9c

    • SSDEEP

      96:27r6shoCs4pHbHF0cRKKxUREEQAk5cVB54x/XHFCWFJYJzzTF3G3zVHCU:DsmQHbHxRKKME6FWXHZLsXTF3G3BCU

    Score
    1/10
    • Target

      mraid.js

    • Size

      40KB

    • MD5

      6c5dc1711df01a9d43b5777cb790f852

    • SHA1

      a848e140eb214102bf4bf7cc43ed47e62a48dfc3

    • SHA256

      a14616848262f5ed49f0727c4dc40b95df7c2e3d145c4bed91d3a1183d9e9399

    • SHA512

      00d4f7897c3d7f4c6d53fbad32addc97ccfdb781d7792e775c51e385fb90b43694d74bfd7e82dce6ea5c185fb91143f8a01bc4408a3f73bd394091d54031eaff

    • SSDEEP

      384:EYSdGfT2QJIGCOIyzuP2QESHmz/SXZ3hsyGENyyFXHjFeYSpyObjw7NLhdlrdT97:RXaoyFX7SIXEmz

    Score
    1/10
    • Target

      omsdk-v1.js

    • Size

      38KB

    • MD5

      068a1502b5c85368af0a863d2de2230b

    • SHA1

      04622229d0a7fa0c66f8d43624f3365a0bd0d81f

    • SHA256

      463080e38d9e1eb87cf8fdb9447d76b5b0e2ace83b04dc503820908765636306

    • SHA512

      23fe8e1f40fa7e1d46fde168149f6cac79a23a6d75ca5a72a9b6e1eee7c1315e8c04c1f978cc7a350df124be1688b840a2f03cb406357cc10148396de5338037

    • SSDEEP

      768:BVFKe8jgobTdXDKZO3OCy0PxjggF4boPq9KMIQ2/9vt5ZBFus9cAZhmUsaZf2ceE:BVFH8UoYO3uIn6boPq9KMIQ2/9vt5ZBZ

    Score
    1/10
    • Target

      playstore.htm

    • Size

      4KB

    • MD5

      b5761ec7f4412406c8f521379cbfe466

    • SHA1

      621c6720da697ab81116bfdd6bf81d1c8ad5e7a1

    • SHA256

      27b9dbf27f7d81fc3cb84c6b3b2430a14fcf78d82d351d38b92dd18537f0bc26

    • SHA512

      e4115829d744cfe44891eb753c4b2ef042d6d5397e5138899ddcfbf9f5a7ac84f2a47af3ca496e11505ca501b8ccadd51b276adafa42d709525b337049d7ed4d

    • SSDEEP

      48:mB79CNoW1ii1n8BfDaqDUMmckWmk1ZVEsMToZtME1NOar5McIp9AMF3Y:mB79C2WT16DaqAMv5ZxoMMUbMrHBFI

    Score
    1/10
    • Target

      privacy_cn.htm

    • Size

      42KB

    • MD5

      49b9a40f599b1089ad0b0394c47c1102

    • SHA1

      d0b0fdb5f6596afedf37032eee87290683b911d3

    • SHA256

      735ba8ee4875ef6529757139876824ac572d255b17db2c75a9887053fd0d9b16

    • SHA512

      43a9be239f71d82efdd06855b9532c9a25a3cd9af3c41fbe407a6b10542bdfd1a3da76b154f0e5d6487a5b66a2521a3f88598982b190660301aef99cd03d5bb9

    • SSDEEP

      768:XEqzEM+RdDBF/f51efzdYSFXKtrhs6WIssFXVqCrX8J/2ue5AFuanVzA+tZxMAXp:2jupQFX9As23Egvxj8TWK0HWZ4Mu

    Score
    1/10
    • Target

      totalcmd_datenschutzerklaerung.htm

    • Size

      3KB

    • MD5

      41cb1edf3388232ed16c7827671b6437

    • SHA1

      0f48049463f07cbd9da8a8c32431e3cd398dec2f

    • SHA256

      d4e95c717f4af725ace14cdcf249171f842186b56c365c9897c5f273ad41af57

    • SHA512

      0c649466d7af3ea3c3985b94f44b5d689fab96226c7667fe798727faabe798edb92cbf8abcc67ec559377da7250c19fc15a116d09e3521c0445d2ee66585fd63

    Score
    1/10
    • Target

      totalcmd_privacy_policy.htm

    • Size

      3KB

    • MD5

      f5bd54f89d624a56a0368d1bf532c60b

    • SHA1

      6fdb247506d811132bc5b51ffc1d82afeb6e72b4

    • SHA256

      eb87dd5ca31a26b9d8a8bc650c324b49027d38242ffc71a89b04e0aae8b4cb4b

    • SHA512

      8dc96be4781bb08b1dcbc3205f59eac592285e98a349a330301ab32e81a25beebd9224880215c62e431d9926c7ed0433e886b61730ada1012ca2f907fcceb263

    Score
    1/10
    • Target

      valentine_cloud.svg

    • Size

      1KB

    • MD5

      64b538523f2f57ceafa9c7ece417171b

    • SHA1

      a606efc682cc849f9d48c300207e5f3a7adb83fe

    • SHA256

      855bab01104793308cdf581deeed532c40dd3dbe1e8299e0dbf7466fb870f3e6

    • SHA512

      73fd11b6d71c2e91c9b2911df2d2c0192e2a7889fe930e1ba5bbf50fb995a486d1bd2fcf50cffef52402ad0030049e1a1069241ea6a2a47e19dd98112cc3d022

    Score
    1/10
    • Target

      valentine_cloud_overlay.svg

    • Size

      1KB

    • MD5

      80918e435efa7673f19209ae9159bc5c

    • SHA1

      c4c4ec0e23e194ef9ef84fdb5de7d41858392b11

    • SHA256

      b00a00e0ad96b358b5b52ac4bd8624ce09265a93fa00c7d3690e328c7328eda7

    • SHA512

      36df543fe4182a6e0e1bb5963cc79bddc518376ae189514f19154a92e97136acf8428ae21f65540b16603d6f5a79b5d3fd0f480ca40f526ad9f5698320facd23

    Score
    1/10
    • Target

      valentine_red_heart.svg

    • Size

      902B

    • MD5

      426880d1ba9ba8a015945a48243ff7ad

    • SHA1

      b17d28e5ea2f0daa69bafaf459c83ea9cba4dbf5

    • SHA256

      2f8502ed133cd74d0d08c35ca3568db51d985e8b91be28c9bee1fd2ebfb687b2

    • SHA512

      21505b66a5968109c45439290c49042495da3ad689ff45caa1af3f0642bbc716c028b8090f5d4b8acf94ad7beb1df6fea4479495c03b27e3eafda20bf5925528

    Score
    1/10
    • Target

      wifi_rc.html

    • Size

      2KB

    • MD5

      54f4f9ab2ae2468c0947214c435cfe22

    • SHA1

      1b994112ea090123e4edbe7c7f96ba4db944d6ca

    • SHA256

      2c84ac20c74a4346706e19d3013a3e69f51f74a6043ef11c88a79d742d85e144

    • SHA512

      7b11ba0f7b07f26912ac83754af1ba1375c4a02e540729a3a757dbeab08cd0dae29d46a638c6226664ae36373ef30ec5be23d6276c89ac38b7e131e4cb7aac01

    Score
    1/10

MITRE ATT&CK Matrix

Tasks

static1

Score
7/10

behavioral1

hydrabankerinfostealertrojan
Score
10/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10