Analysis
-
max time kernel
2094819s -
max time network
144s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
18-12-2023 12:15
General
-
Target
new.apk
-
Size
5.6MB
-
MD5
787d01d67c2a0d4df7f100c8550e92b3
-
SHA1
e71d636f44d4b5240c1d743d2c3164ca7ee0fbb6
-
SHA256
496e20eb04c7fb0fd64a1d3b519cb2515656e0486253f376176fdc996efebd16
-
SHA512
a86c7c7ca152cf49273d3d157a04156a30e42b366b7ccbb2bf078cbdd7612862c8d520d1849f868c3dea26ea9f9951e2020686aa12eeff8f42457d554282b112
-
SSDEEP
98304:jWvbn+hU4MIVGAxWWCICz95kP5zC/kRnvTzXDW640lfitWBacyjywQpHuGc4qL9l:JU2YnkRnHXDWx0RiQdyjynFAL9l
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.ahzmpwhp.mpjvegk1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5a6a2d987adc747106b4db2e2a2fe9983
SHA141332e8627f04c05f8dd9d43af85297a81f537ae
SHA2562715bec457ae955a76ec7e7412baa823c6710df476617fb1275d0555f0c36a6a
SHA51245dfa8fd939bd662e694a2160f2ab063b2fbf9071aa39bece3a43e0ba969f84bb0fac2c7797300aa28ba6812c1f5dbac764fa7bdbe0e7a73bad1721c1bb13f26
-
Filesize
808KB
MD506fd693b404efa76d31722f787830e4c
SHA10f876b5913519fadd99b3bf1b78e114d795b8f52
SHA256ad3ae30588d1f1ac879a1b59e7ed1889b740f5e765c545b7b07bc9eaf90b37b3
SHA512add4090e2063f83b9d2c18ac6e7075f7afe88bd174e0bde63df942213abd07f18c161142d4d81708fd1260e53d8edeff21d95a704813975963bba358ebbb28be
-
Filesize
1.2MB
MD50e3a337a1a508e918086d9f244ca4831
SHA19df8518145607042363ef820f58d776204a1506b
SHA25687a9505f964c5bc6287672ef2a3b05ee8b1d067d44484fa79ed7294840833bd4
SHA512f03ac7408a9f76bd7ab89c8e011942d25cb1fcef8041924188127948dcc7f3abc09892b53e8891fec1a115a6c6de3626234ec6deb0fa7a8c5329c0d853835a76