Analysis
-
max time kernel
3518895s -
max time network
158s -
platform
android_x64 -
resource
android-x64-arm64-20230621-en -
resource tags
-
submitted
07-08-2023 20:32
General
-
Target
a5ca7aaf8b5324b1414760517bef1517527f952cd1c2fac907c2f83d2e3e4bec.apk
-
Size
2.4MB
-
MD5
1b5f1dfe3bb361d3b49bbe6c257d15b7
-
SHA1
bb2fc3f5a9d83f57170e58e47d77406088ddca45
-
SHA256
a5ca7aaf8b5324b1414760517bef1517527f952cd1c2fac907c2f83d2e3e4bec
-
SHA512
59192b55fb440ccc2d53245b0eaebb5340712d26166ff258a584971ded7c5618d0653f6ac5b78467a8ef5f988397828b4cdcfc8c022e9d16939857c04b4e022b
-
SSDEEP
49152:A5fbH5QSQpB4QczFiziv6WmEcJ0S8o7jEho/TK5OW4N:A5fr63RczwzTnjDgWW5aN
Malware Config
Extracted
hydra
http://flocomonuncomunters.net
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.quiz.public1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5eb6455b79b9d97da49636f52f4115409
SHA1d192c93bf516cd75a1d4926e13c0fb1b64f87ac3
SHA256336d1293dd2e21ea145f437ca387a5c8d2ead20bb6c789335eec2bd161d4de62
SHA512e470c2409b2357e870dfa243075188b3886e7b38096c123146932c1c45b9cd6a1f6390060a9515b928bf74748d3525b4e414e62a210bbea2273195970b31ae3a
-
Filesize
3.6MB
MD51495b9ac312e2adad198b70e4b993969
SHA1968fb1cf9bbdd52658f4a136f90ee6fe6c92d448
SHA256fa172aba9fac5e75af6b90703fcbbf08074ff96aa9b1613d534a73bf1de36ad9
SHA512645e9d664f36c486a80e3176e0ab1b8eaf77c74a10ac7c0e568bf79cb91d2c6a48f7a8edf2443e3dcec58873b8cabe6a83ad14ca84df8b350286a9e183f66ce4
-
Filesize
131B
MD5d04118693bcfa411545e8648fb30d629
SHA10ad8f78158d5357312c7abf6aa810414936a6470
SHA2562738bcff6bae1e34affe960cd4b11fb29c57f51bed1fa42ae3946db48176c565
SHA512db9cbe51bf0479897ce9adb49889895505dc0b3cb0e945f068ff28957c259a72f33353610f83fc4d11f747764d6c27216da43c6c0ffe8a71d296f8973d2c6a7d