General

  • Target

    7e95e9a306886dadbae68c586bf19eec6903bac15290fd60c47d29a2e3cbf047

  • Size

    8.1MB

  • Sample

    231220-dafzlshacl

  • MD5

    499da9f8c6d8a2437f51637bc73fcdbe

  • SHA1

    069b538392a6c3199cf5e503ce5d3f9cf60fe7ac

  • SHA256

    7e95e9a306886dadbae68c586bf19eec6903bac15290fd60c47d29a2e3cbf047

  • SHA512

    aed3b8bf2756173c292529b70976f604d204d723ce63186275020198871011bc072b4db7918e586883687f1b8f1981529880d44d59a7cfffd791942b2e3358c7

  • SSDEEP

    196608:blyA4a4P1J9G52iLy/b5cCTIpS0djSCWOsx2GjsgWg9NP6:bkA4aoBxRb5c3Fxw9jsFEP6

Malware Config

Targets

    • Target

      7e95e9a306886dadbae68c586bf19eec6903bac15290fd60c47d29a2e3cbf047

    • Size

      8.1MB

    • MD5

      499da9f8c6d8a2437f51637bc73fcdbe

    • SHA1

      069b538392a6c3199cf5e503ce5d3f9cf60fe7ac

    • SHA256

      7e95e9a306886dadbae68c586bf19eec6903bac15290fd60c47d29a2e3cbf047

    • SHA512

      aed3b8bf2756173c292529b70976f604d204d723ce63186275020198871011bc072b4db7918e586883687f1b8f1981529880d44d59a7cfffd791942b2e3358c7

    • SSDEEP

      196608:blyA4a4P1J9G52iLy/b5cCTIpS0djSCWOsx2GjsgWg9NP6:bkA4aoBxRb5c3Fxw9jsFEP6

    • Hydra

      Android banker and info stealer.

    • Hydra payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks