Analysis
-
max time kernel
1934761s -
max time network
156s -
platform
android_x64 -
resource
android-x64-arm64-20230621-en -
resource tags
-
submitted
20-07-2023 12:39
General
-
Target
CommerzbankSecurity.apk
-
Size
1.0MB
-
MD5
cd36a045167b2cebc77f7b28b00309f1
-
SHA1
b7388ff67adeedc64cea4a6592e69aef474e21b8
-
SHA256
c0e391e254b74359896d287069883652a4b8bfd9ce2fd20a3cd7b441e1cbd600
-
SHA512
6a63699dd59ec9f87c8ebc56d022c884d5f738b06d6c9c83a32e1b7c43734030ab6e9acf1e7685015511da327462f6d96394ff4007dbff147dfaf1228c6781c1
-
SSDEEP
24576:v6MQbH1tTcl/3lLqU3jhV5ZpjLdsmxaire/3OB77FARDEjGiv:CM+H7Tcl/3YUzhVpjBdxJrsOMVEj5v
Malware Config
Extracted
hydra
http://213.226.123.27
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.grand.snail1⤵
- Makes use of the framework's Accessibility service.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f