Analysis
-
max time kernel
2201629s -
max time network
135s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
19-12-2023 15:36
General
-
Target
50d3bdd395bfa25063e6b614e9fd953a.apk
-
Size
2.3MB
-
MD5
50d3bdd395bfa25063e6b614e9fd953a
-
SHA1
be8e1c074e1dd5df8d81b94288569d0078da4709
-
SHA256
c8f28fa18e582f5e37e2ef8c07df0c1eadf2aed88de3561f962b08224ed9445e
-
SHA512
89ec50f52f615403fc1c63f9c8624f71b1a491818a4bfa0e197054bfd4375cbcc7f133b56cfbe3f48da3c5f2837f82037306335114a64a0e72ef942f277ee14e
-
SSDEEP
49152:ALVzpOGT22h41pC7/IH/yP4JoN0+L6c57XYEVAAbrBwID+bcKFyNe:AL1pOMRWZNJUt6M4ar+IW1QQ
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.kzvxsera.egalaeiy1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
935B
MD5a151a3230a8eaba5bf6309b27b688f23
SHA1add7fe84865721696cef01f952e72af52fb81a2a
SHA2564f02f111382bc8f41f071c45dedb207abee5bc8ef20ee49a0635df05bda10340
SHA512bc18a0ff76a7f1c0846c24fce168762540b804a84eb53c89e9b572deef77fe4d91ffbdddbf38a379b1fa6a077560595c7ddd8d405248ece209e1e99cc02910a7
-
Filesize
252KB
MD534b3a0b5887bd2b7460900e14f19f932
SHA14fdc15810bb4fff9b704dc034c16d54b6971b566
SHA256d6fd1a4a8867989b127eea4ff310b8ca872e59c0522ee877d91dd4335ca41dd6
SHA512e332d3b92a05e5115cb5a2c8f460a7f9bda4f2e64aeaee0c5e47bbdc26251ab45a5171b2d1281a7e542ba5f41ecc43e8779584a1c55b4b7ccb086ffe6b830e45
-
Filesize
567KB
MD565a8cb9abae8735bba0ec4b56fec47c3
SHA136f9289b201d998e5aff91b9374c1365624ff754
SHA256a0be603430546dd2ac6357210ac93b86dd94ced8b41d6a036b4e877ab946e872
SHA5120db4cbc019d220ba1751aa8800736006a82cf1328679bf9758d586273f534960a27bd9f033d3f444e18fef057ee6deb0b3714b779fcc89a8098afe4827f7b8db