Analysis
-
max time kernel
1754117s -
max time network
138s -
platform
android_x64 -
resource
android-x64-20231211-en -
resource tags
-
submitted
14-12-2023 13:36
General
-
Target
3154684c4192a1ae7a00f9f61d3024e2d25a85508c512094a771f878c3130848.apk
-
Size
8.4MB
-
MD5
ad53ff0a6090ab4904bc589ebbf64bb0
-
SHA1
4caa507ad88af628be9d5e53a4dcbfba34c4351e
-
SHA256
3154684c4192a1ae7a00f9f61d3024e2d25a85508c512094a771f878c3130848
-
SHA512
df103e1d1ba138b6a87dd4c10c9de954db2732627d32ff3cbb821ee87cbfcbbc52b3123070bd3304f6f595f064fb28b581694788191ff6ec8371e11be40067b3
-
SSDEEP
196608:k1aEShpFlM17N317z391qgpyNP6QDWx0RiQdyjynFAL9mTO:k1ahnHM17pFz3DBp2P6cWabyj40IO
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.vsmucodt.bhvxnft1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.7MB
MD5c748f33d0a5dcdcf763764474981fa8e
SHA11c90bc0037f8a796b93c8bfea5cead5a8001f871
SHA256507ba1fdf4e849ec720edc922dab8cb0c899c68861387277b499c40be6ad33bf
SHA512c84fbfcef322ee4fb62e60f3df52da2f93cd71ee28360f2f16a15645dcf7bd76ed3cb83c8c82ae7310669feef780e1a6574dab0f21e592b0618c2e6149567d0e
-
Filesize
538KB
MD5dc5e16107784652f5099f744c35ed328
SHA1326589b22fb30cc39213ee5aa13b44d95528a60c
SHA256a0f08f6b999f2f21496cfa5ee9ad32e809d6463a845177a9ba1ca47118f87081
SHA5124a6080c88047254df20e473af9d231d8eb187691bcb6855ab980bd7ebc0137cf5e2064f3c7e8678b7b68292efee47af185f8a80f7d50722f2d6bed1926ea5d2c
-
Filesize
1.2MB
MD5dde288fb8a3b26bc1e943fe18d2407c4
SHA14095f659245eb5e149d8e3c8cbd9a9fa70854d30
SHA256fa5e6db97f003fad821603e02c949b6d3c07a3c63077cb6cf1e5f92dd8c2d3d5
SHA51258dc81450aff626c175128373e70a9e6b6ef6aa8c03de0b22b12971bd091fa8b4da8f3244f0f56b35beeb51a65d9802b824e57af27a2ee2634033f08f80b3c79