Analysis
-
max time kernel
2206529s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
19-12-2023 15:36
General
-
Target
50d3bdd395bfa25063e6b614e9fd953a.apk
-
Size
2.3MB
-
MD5
50d3bdd395bfa25063e6b614e9fd953a
-
SHA1
be8e1c074e1dd5df8d81b94288569d0078da4709
-
SHA256
c8f28fa18e582f5e37e2ef8c07df0c1eadf2aed88de3561f962b08224ed9445e
-
SHA512
89ec50f52f615403fc1c63f9c8624f71b1a491818a4bfa0e197054bfd4375cbcc7f133b56cfbe3f48da3c5f2837f82037306335114a64a0e72ef942f277ee14e
-
SSDEEP
49152:ALVzpOGT22h41pC7/IH/yP4JoN0+L6c57XYEVAAbrBwID+bcKFyNe:AL1pOMRWZNJUt6M4ar+IW1QQ
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
com.kzvxsera.egalaeiy1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kzvxsera.egalaeiy/app_offline/pdndmc.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.kzvxsera.egalaeiy/app_offline/oat/x86/pdndmc.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD534b3a0b5887bd2b7460900e14f19f932
SHA14fdc15810bb4fff9b704dc034c16d54b6971b566
SHA256d6fd1a4a8867989b127eea4ff310b8ca872e59c0522ee877d91dd4335ca41dd6
SHA512e332d3b92a05e5115cb5a2c8f460a7f9bda4f2e64aeaee0c5e47bbdc26251ab45a5171b2d1281a7e542ba5f41ecc43e8779584a1c55b4b7ccb086ffe6b830e45
-
Filesize
567KB
MD5bb5a2b7b4d9163cd2e213469d086ef3c
SHA1f68ec0b323ac6a6ac7623342edb91786281f6392
SHA2568aaeb8f072962aa51615079a23fe5c863c069bb9be913fe9918fdd63b4a81a97
SHA512acf6870d2436372808155435830f0fcdd86d6053cdb4dffc57bd8ddd20ce57ee7102f7c7387b7a263e02d99a3116547ca1edea2b0ac42e09cfaa5064929bbbe8
-
Filesize
567KB
MD565a8cb9abae8735bba0ec4b56fec47c3
SHA136f9289b201d998e5aff91b9374c1365624ff754
SHA256a0be603430546dd2ac6357210ac93b86dd94ced8b41d6a036b4e877ab946e872
SHA5120db4cbc019d220ba1751aa8800736006a82cf1328679bf9758d586273f534960a27bd9f033d3f444e18fef057ee6deb0b3714b779fcc89a8098afe4827f7b8db