General
-
Target
15d9a5bdde36d5f214d6963bbf05e4cdcd20e86dcd539f771c972112c75dc4a5.bin
-
Size
3.1MB
-
Sample
231120-1wrdssbb4y
-
MD5
dbab340d07d659ac69fe2ae7a7119ace
-
SHA1
b11519fd265fab67afe9e70edb661a52f413a187
-
SHA256
15d9a5bdde36d5f214d6963bbf05e4cdcd20e86dcd539f771c972112c75dc4a5
-
SHA512
1d05440aee275f350a956538890170030a0c28ad9f62691ca780c1570787065a0ef1290cfd7fd748bb1d772105f6b2621a870ca3ef32926b2303c44959f1c07c
-
SSDEEP
49152:+NNGa1n+JGiJjFCmwTkH+u5DO7PrRQWbMl9PriWcHJ3dC:qh+JGi3ATk95cruwm9WWcHJ3dC
Static task
static1
Behavioral task
behavioral1
Sample
15d9a5bdde36d5f214d6963bbf05e4cdcd20e86dcd539f771c972112c75dc4a5.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
15d9a5bdde36d5f214d6963bbf05e4cdcd20e86dcd539f771c972112c75dc4a5.apk
Resource
android-x64-20231023.1-en
Behavioral task
behavioral3
Sample
15d9a5bdde36d5f214d6963bbf05e4cdcd20e86dcd539f771c972112c75dc4a5.apk
Resource
android-x64-arm64-20231023-en
Behavioral task
behavioral4
Sample
libcrashyltics.so
Resource
ubuntu1804-amd64-20231026-en
Behavioral task
behavioral5
Sample
zoom_app_sdk.js
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
zoom_app_sdk.js
Resource
win10v2004-20231023-en
Malware Config
Extracted
hydra
http://ciopuntinoapoldoaeuoererapol.com
Targets
-
-
Target
15d9a5bdde36d5f214d6963bbf05e4cdcd20e86dcd539f771c972112c75dc4a5.bin
-
Size
3.1MB
-
MD5
dbab340d07d659ac69fe2ae7a7119ace
-
SHA1
b11519fd265fab67afe9e70edb661a52f413a187
-
SHA256
15d9a5bdde36d5f214d6963bbf05e4cdcd20e86dcd539f771c972112c75dc4a5
-
SHA512
1d05440aee275f350a956538890170030a0c28ad9f62691ca780c1570787065a0ef1290cfd7fd748bb1d772105f6b2621a870ca3ef32926b2303c44959f1c07c
-
SSDEEP
49152:+NNGa1n+JGiJjFCmwTkH+u5DO7PrRQWbMl9PriWcHJ3dC:qh+JGi3ATk95cruwm9WWcHJ3dC
Score10/10-
Hydra payload
-
Makes use of the framework's Accessibility service.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
-
-
-
Target
libcrashyltics.so
-
Size
17KB
-
MD5
e509b005121e182dd12b9756377d8658
-
SHA1
842448f7ad2fd2e2c956955db5fb33df70a66ad7
-
SHA256
26bce973d073f1b6131b8694a2807facdef60a15d70406fefbbfbfacb46db78f
-
SHA512
6739000dcf0177c13636401113f012ce2028fa937480c9c92b7edd34918673e829cee1f2f474ed86271c9afc43a710302405ea7917cc9a489d0f084325495e87
-
SSDEEP
384:jNOhsWSVjz947yUZ88FG7fW3r21VmU30UTpXC0/4hOl+I4+F+t5s:h9WSVjz947yUZPg7fWKTmU30UTpXC0/h
Score1/10 -
-
-
Target
zoom_app_sdk.js
-
Size
13KB
-
MD5
31a343f9b3a784c4b1e2990b9a61fb47
-
SHA1
4e7b6cc8797900fcf583a492781e6d718c4caf56
-
SHA256
fdb9baa1a9104286ae12ecff9aa3321d96680e4309e7706257dbf8b9d9a4e6f2
-
SHA512
96e60ad34d9a9b29fca22c1d1a889b67137b40d668e34d5e57560b8b4686a757e421e002074e89192ff98591358c2163f8554af6fb2f11724798d5b371dd3ac5
-
SSDEEP
384:TddnnqKUJI7Yb6l69k6z6l6gI6h6g3kXR:TddnnyJIE6l69k6z6l6gI6h6wkXR
Score1/10 -