Analysis
-
max time kernel
2328131s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 01:46
General
-
Target
7aea29658ad2b4aa603442ab56ff391d0d9b30f3996c8fafb6e10d50bc0ab7ae.apk
-
Size
3.7MB
-
MD5
645e0e45a9f31643af73cafb6ade5229
-
SHA1
90ca44e4a382bb8ce2567b0606f6cd38e6b1c087
-
SHA256
7aea29658ad2b4aa603442ab56ff391d0d9b30f3996c8fafb6e10d50bc0ab7ae
-
SHA512
5cf79cc779c64d0745cf278079ad20680e6595378ece72d1496d369484f18a42ac4390ca2b8f9ed7217e1b33af4419eb9ae4dbd31776eed5152c8b0d373b8c27
-
SSDEEP
98304:mOHNetf++GWwfXgbSP8k38Ug55Cgy/DJ0LMheUi6LjL/:B8f9GJXBP8W8Uk5SbJ0LMcCL/
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.turkey.reject1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5179603d4683e87513d0bb1d702d559dc
SHA159901d3d0d9543ea4bdbd52840fdafbbabc05426
SHA2562c78e9cba2f575428f88079bda50c28666497e52c6afbe2ae7e97a0762e40d13
SHA5129daa9b27425cec4d3fb32b32708ae97c91559bc010a16885159f29de9b062fa569d87e74ce83e3cafd396dd90fe929872dd2eb827c95f8863f40d8af34ad8a80
-
Filesize
1KB
MD5ecde79d7c5a46c2db02197890fd8fdc5
SHA130af28a1a67c00055c122eb4836d5507497ed815
SHA256d179038471132c064622ded41234a79e27f3a9cfcab526360a3fa0f4c16b9787
SHA5129fbfd14cdda2d8bf33b746e6d3f1d356bcb33b026a1423d3cfbb56ea35aa700e1b785a24c0f02bc50e7d435627850624a4fc82198bf8cdd9c071bd6abef4bd65
-
Filesize
5.0MB
MD56ff45069ad6c726842a6215431e4057c
SHA1b483ff6942a834895cd255ff8c17f9b81b12d042
SHA2560472292bcc0c0ff67e181f8fefe60bba9ad48ef93f45cfb4f0a08dd09b9ef395
SHA5124c0c3a4056430f6b82f6de379713eb44a0f91ebe3d082a0f4375d1f80641e76cad9ae11d3e060cd661e0a757e1b805c18f8d9f5629c5cc92af3727ccc1119c34