Overview

overview

10

Static

static

7

646538cdfc...bb.apk

android-9-x86

10

646538cdfc...bb.apk

android-10-x64

10

646538cdfc...bb.apk

android-11-x64

10

createjs-2...min.js

windows7-x64

1

createjs-2...min.js

windows10-2004-x64

1

vpaid_html...e.html

windows7-x64

1

vpaid_html...e.html

windows10-2004-x64

1

webClipper.js

windows7-x64

1

webClipper.js

windows10-2004-x64

1

Analysis

  • max time kernel
    458383s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
  • submitted
    10-10-2023 20:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    646538cdfc45e8ef64816ed9faf824b52cf6b856eada0e9dd4e3fd92f702b6bb.apk

  • Size

    3.1MB

  • MD5

    1dfde650c7fcef063427d3e78e4698e9

  • SHA1

    f711c2fa18f0ca8902eea6bee753eccce637b824

  • SHA256

    646538cdfc45e8ef64816ed9faf824b52cf6b856eada0e9dd4e3fd92f702b6bb

  • SHA512

    32112ba5ae9b5cc900b9506441c74620c304bcfdbeff1ec70cb4f5c57d708539f803d4540088bd68f8740e7b1aae862ac1dbb95a7bc74d117bd5b805e9275dc9

  • SSDEEP

    98304:f4gX+t7BIe8QgUZzPKIRcfJoYxn3OD4AFfheLAne:f4gXi7BN8QgUdPfehpJ3O3fhEAne

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 2 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.knock.gossip
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:4665

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json
    Filesize

    1.9MB

    MD5

    71bbf12cc00408a54cc34f4ffadd12f4

    SHA1

    42c7236e009f1405e0dc7d31ef5d4c8392032d7e

    SHA256

    8aba134ba5cecee7e80131ad416071283d145174817e0eaf18d7b100097805ab

    SHA512

    0b110e4bed1b362938643cc8a8260f8ab9a6925faef3b561250a64d7885463d3825d01d16ddcfb3dd212b30b3285bec8090b7d9367d80888e225ec6fa3146705

    Download Submit
  • /data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json
    Filesize

    1.9MB

    MD5

    bfb1e01675df7636992c67bd205940f7

    SHA1

    35fe01dfda386094787cd68dee8c6480a569f80f

    SHA256

    20fde64c79e6ad996533b088b3f00a0b5f1baee95c795dbff12076200aef7270

    SHA512

    88cb3459579df8953a6870104b071d30089bbaafec148e186db7196d1073d43376cd01185f152ecbe8efe9c8207ccd626b111019c75e4102ea45306f4ba43cae

    Download Submit
  • /data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json
    Filesize

    5.0MB

    MD5

    33c7c9950172a836259776101bcac096

    SHA1

    f5c8598a28eec0bebf7e07fc23512c89b30472d6

    SHA256

    dc302c0fd08473b5916fc3d26a8035df332391d9535da610c52fcb2ec48d55ef

    SHA512

    75b0ed13a94fabe307c48971cf13150c9c3ab9f4c4128bcb1d71519b4d2aff2221f72e7174970b468ff00b09ad9c9ac613e6de586668fc6f9ed085366b35286d

    Download Submit