Analysis
-
max time kernel
73349s -
max time network
30s -
platform
android_x64 -
resource
android-x64-20230621-en -
resource tags
-
submitted
28-06-2023 23:37
General
-
Target
58feca1b4b8c19b000d7911e2586659d65d8add75d96c3611530afc3cf11f841.apk
-
Size
1.8MB
-
MD5
a2afdca2093a9a2de5b2b678ce50184e
-
SHA1
6d952d50d676c03c2d9f8ffb962bdb9f13179a6f
-
SHA256
58feca1b4b8c19b000d7911e2586659d65d8add75d96c3611530afc3cf11f841
-
SHA512
d19fd5128a6af238cfd22adaeabbb4e869153c1c42e5266a12ea81e4869007c5f848f0dcd434289a80b693a6b6cacf4cdeda1812bdd0d1cb31466fcaf3dd8f06
-
SSDEEP
49152:p5tLHOuG8mWsyLoA3C50utRd+8nZ3yb8Yz7YU7RNHFoIrEjyK:tOuu150Ud+8sb8Y/YU7R/o0EjT
Malware Config
Extracted
hydra
http://yolderyasibizdenizgez.net
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.night.mail1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.night.mail/app_DynamicOptDex/oat/xJDBZ.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.night.mail/app_DynamicOptDex/xJDBZ.jsonFilesize
972KB
MD52f509df128ce2270729dabe58f5df516
SHA132cdc29e097df2a82e4d84b1fa1c810a0c47ac9d
SHA2564fee231bc201cd123235f4d30e0c9d88e4bff50408cff3a8ab86abbb1b5ca7a8
SHA512d67950e8f62d5c9bf604b091f42cfbbb30aa32a3b31e1bd636318cce32a1b71b14461b1708021dc6cbbae4714f5d0f6c63d267b5870132369a4090b6dcde0ed7
-
/data/user/0/com.night.mail/app_DynamicOptDex/xJDBZ.jsonFilesize
2.2MB
MD5f186d37bc3df8c2dfb8f0fb57a7e5ded
SHA1c33c48c47ccbc865d21020b070f26562234d2c19
SHA2567e548c7b93c26d4d6bf8b31ce76c6c14d9c3f91e69b307807c6b1234e55047ca
SHA512b8b5db6a85a69438387fbe790aa8cef640397a09a322ab3af037cca32cce00973ff7a0d74bf4cb2242987d28cbbe41de2d0d69481da03551334656446ca36a36
-
/data/user/0/com.night.mail/app_apk/payload.apkFilesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f