Analysis
-
max time kernel
2320687s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 00:47
General
-
Target
75f9f66bcbfb732b3720f9b56a5b56a3a671ff4386b0b7dc8195124b0db206c0.apk
-
Size
3.2MB
-
MD5
abcef2353f293e694fe3073b53528441
-
SHA1
0ecf181ad163bf5dc4e316ac61b3d2453ade356c
-
SHA256
75f9f66bcbfb732b3720f9b56a5b56a3a671ff4386b0b7dc8195124b0db206c0
-
SHA512
253a63c8c677826085727ef6d73b01142503424c3f952515bd9e6bfe0b4900e9c1b08faeb98f3790042255994ff9d57f274066315981711c0f32e1936bf3a608
-
SSDEEP
98304:Vz2v/oOd4+e/h8WBJbiBUUPBnzvU0C/MHpCNnvB:koJ+e/h8WfmBxVRqMJC/
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.knee.grit1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.knee.grit/app_DynamicOptDex/Cb.jsonFilesize
1.9MB
MD5fb546b96e7982734b8c2fcd30400e7ab
SHA1bc506453e267ae32c2941bfddecc845140b019d9
SHA256385151bb68cbdd60ea8c33c112a7cd38add4d8a16aefca8ab5567527725c753e
SHA5125646c3f0a8730cb1951cff3f5a5afd545211c7058f89e4c4935171996c7581a6b61ae7cadd9a44d85e12e2f30bcdd8fcaf5d3a229ded045880a0cb0c64e1f7f3
-
/data/user/0/com.knee.grit/app_DynamicOptDex/Cb.jsonFilesize
5.0MB
MD5d95f1101eeab1f220343e0ed048ef7c0
SHA1cdc16afc942ad5a8d4b6ceae23edbcfa67ecd01a
SHA25633da05b58fd65c304b74a640a9851b5f6783ee6a7272e4b60908663c35fea4b7
SHA512166a8d8e20046d6437da342e01203aa951b68eb1bc4da8d2b7ec6ac1a4a73a4121a49df7e4ebd27bf48a51b5050c36cbb836cce747c50bdeb4ac0254b783497f