Analysis
-
max time kernel
73482s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20230621-en -
resource tags
-
submitted
28-06-2023 23:37
General
-
Target
58feca1b4b8c19b000d7911e2586659d65d8add75d96c3611530afc3cf11f841.apk
-
Size
1.8MB
-
MD5
a2afdca2093a9a2de5b2b678ce50184e
-
SHA1
6d952d50d676c03c2d9f8ffb962bdb9f13179a6f
-
SHA256
58feca1b4b8c19b000d7911e2586659d65d8add75d96c3611530afc3cf11f841
-
SHA512
d19fd5128a6af238cfd22adaeabbb4e869153c1c42e5266a12ea81e4869007c5f848f0dcd434289a80b693a6b6cacf4cdeda1812bdd0d1cb31466fcaf3dd8f06
-
SSDEEP
49152:p5tLHOuG8mWsyLoA3C50utRd+8nZ3yb8Yz7YU7RNHFoIrEjyK:tOuu150Ud+8sb8Y/YU7R/o0EjT
Malware Config
Extracted
hydra
http://yolderyasibizdenizgez.net
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.night.mail1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
972KB
MD52f509df128ce2270729dabe58f5df516
SHA132cdc29e097df2a82e4d84b1fa1c810a0c47ac9d
SHA2564fee231bc201cd123235f4d30e0c9d88e4bff50408cff3a8ab86abbb1b5ca7a8
SHA512d67950e8f62d5c9bf604b091f42cfbbb30aa32a3b31e1bd636318cce32a1b71b14461b1708021dc6cbbae4714f5d0f6c63d267b5870132369a4090b6dcde0ed7
-
Filesize
2.2MB
MD5f186d37bc3df8c2dfb8f0fb57a7e5ded
SHA1c33c48c47ccbc865d21020b070f26562234d2c19
SHA2567e548c7b93c26d4d6bf8b31ce76c6c14d9c3f91e69b307807c6b1234e55047ca
SHA512b8b5db6a85a69438387fbe790aa8cef640397a09a322ab3af037cca32cce00973ff7a0d74bf4cb2242987d28cbbe41de2d0d69481da03551334656446ca36a36