Analysis
-
max time kernel
2303693s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 22:16
General
-
Target
d37354a9ee083d1cc8d337cd4008231d303c763768c3fe2f443c7bb4ec184522.apk
-
Size
3.2MB
-
MD5
be81405574365c97fc0b3010cc039cad
-
SHA1
5a7ff7b6998ae7de9a94d4fb5af4805b6eab4fb9
-
SHA256
d37354a9ee083d1cc8d337cd4008231d303c763768c3fe2f443c7bb4ec184522
-
SHA512
9e539cc62019eab99aecf02eb29b517467e257a46392c2da69831e4cf39818938d86c50c427a5afa4de743f073d2699275ed3ca14299e2b94545011854e93bbf
-
SSDEEP
49152:+mZ5+Rb9KN9/QaJGiXNc9GUnDdYxU82S0lZYfvuXibOHh4K4844qkGdWGNTc:dlJGiWYeD0U870lZs2XNB4Kp4LjTc
Malware Config
Extracted
hydra
http://cioroapapoldoapolawe.org
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.doll.cross1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bd22fe99156cb51e9fb04ff23e314e54
SHA1f4841fd12aaaf929be3a2831603aa781e7be9c1b
SHA256ebe8a5ec3f0a37e8a692c38f5e97c7162d8abff3972f99bcef7665421084227b
SHA5125d0ee9acff9745936316a19d05646a173ca82a8eead66662f2d2d01034a70efb4cde7b8ccfa605f7182a37f1a080d52e64a715cd1d00d4e19959f40c0b7e780c
-
Filesize
1.6MB
MD5a1dbe9b933d6f3d4cd7b98112d5e02cc
SHA129b2b90c77c9a8c47b0af7e76424c44129b51f7f
SHA256234070560b50446a239795f6f850d7bb15bdc6e1bd808304627e5043c23aa289
SHA5122c0f98bc377d2fd123391e4bd4711658b620e570721bad04e2c505ed461e44c8d8dc06be636f415581076aee0b2ce3304d2ce59f69fdd1924815a21efae9c00d
-
Filesize
1.6MB
MD502699b682e0aa8c1c3222a5bf56b442a
SHA1ccacd7fff021fa43ec4c3a38fd56a04f80a6797f
SHA256b39149ab73a76f84dddcb8fc2e2191b82a60fbef337460186264b54ab6298bfc
SHA5125ebb9cf5e3b81810fa9dce8ce77f682009d562778f3ecc5cf1e123c42fce4c27d22b674fee5f00c5472410eb8028f45871bfbbf475e5580d4329108b18e54a7d
-
Filesize
4.4MB
MD57eb3a44802ceef8f67ac39fa5a2fca84
SHA1dbfdb898d194e2be0d746332def8c841341d47dc
SHA256b491067b9dca0dbdfd07efbebbd5e683942645b5a11aaf5f2380060ec767d414
SHA5129441bac47d0685cc19c09fe7bab34044b86bd5b52f388a5ad643428c1af4483c46c1fe9b29277c230fece2ab95ddfef4dafc99ee79e7a759c80429f1ce83ba75