Overview

overview

10

Static

static

6

d37354a9ee...22.apk

android-9-x86

10

d37354a9ee...22.apk

android-10-x64

10

d37354a9ee...22.apk

android-11-x64

10

Resubmissions

20-12-2023 22:16

231220-16txnshbe2 10

20-12-2023 22:00

231220-1wvq8ahbb5 10

Analysis

  • max time kernel
    2303683s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    20-12-2023 22:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d37354a9ee083d1cc8d337cd4008231d303c763768c3fe2f443c7bb4ec184522.apk

  • Size

    3.2MB

  • MD5

    be81405574365c97fc0b3010cc039cad

  • SHA1

    5a7ff7b6998ae7de9a94d4fb5af4805b6eab4fb9

  • SHA256

    d37354a9ee083d1cc8d337cd4008231d303c763768c3fe2f443c7bb4ec184522

  • SHA512

    9e539cc62019eab99aecf02eb29b517467e257a46392c2da69831e4cf39818938d86c50c427a5afa4de743f073d2699275ed3ca14299e2b94545011854e93bbf

  • SSDEEP

    49152:+mZ5+Rb9KN9/QaJGiXNc9GUnDdYxU82S0lZYfvuXibOHh4K4844qkGdWGNTc:dlJGiWYeD0U870lZs2XNB4Kp4LjTc

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

http://cioroapapoldoapolawe.org

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.doll.cross
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    PID:4985

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.doll.cross/app_DynamicOptDex/oat/rmDMM.json.cur.prof
    Filesize

    1KB

    MD5

    49a213c1d3dfbcc1bc33b50b4c9eb15f

    SHA1

    03fe869be897f3d8706e6342c2bb4f7cb02f3ad9

    SHA256

    90188d3f41f479e4d6772aceb693ce6bfbc8b24017a22b3ea912cc2044662fde

    SHA512

    89730a959c05aa70cb60315730f1a9cdd6be1f0ac267a06e6cb58d75277259392e007f2bee9706922ea544570cb3bb75748850b3ababac32220edfe58b9a335c

    Download Submit

  • /data/data/com.doll.cross/app_DynamicOptDex/rmDMM.json
    Filesize

    1.6MB

    MD5

    a1dbe9b933d6f3d4cd7b98112d5e02cc

    SHA1

    29b2b90c77c9a8c47b0af7e76424c44129b51f7f

    SHA256

    234070560b50446a239795f6f850d7bb15bdc6e1bd808304627e5043c23aa289

    SHA512

    2c0f98bc377d2fd123391e4bd4711658b620e570721bad04e2c505ed461e44c8d8dc06be636f415581076aee0b2ce3304d2ce59f69fdd1924815a21efae9c00d

    Download Submit

  • /data/data/com.doll.cross/app_DynamicOptDex/rmDMM.json
    Filesize

    1.6MB

    MD5

    02699b682e0aa8c1c3222a5bf56b442a

    SHA1

    ccacd7fff021fa43ec4c3a38fd56a04f80a6797f

    SHA256

    b39149ab73a76f84dddcb8fc2e2191b82a60fbef337460186264b54ab6298bfc

    SHA512

    5ebb9cf5e3b81810fa9dce8ce77f682009d562778f3ecc5cf1e123c42fce4c27d22b674fee5f00c5472410eb8028f45871bfbbf475e5580d4329108b18e54a7d

    Download Submit

  • /data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json
    Filesize

    4.4MB

    MD5

    7eb3a44802ceef8f67ac39fa5a2fca84

    SHA1

    dbfdb898d194e2be0d746332def8c841341d47dc

    SHA256

    b491067b9dca0dbdfd07efbebbd5e683942645b5a11aaf5f2380060ec767d414

    SHA512

    9441bac47d0685cc19c09fe7bab34044b86bd5b52f388a5ad643428c1af4483c46c1fe9b29277c230fece2ab95ddfef4dafc99ee79e7a759c80429f1ce83ba75

    Download Submit