General

  • Target

    824fd338bc6728c891cde35ab8cb77c268b60ed291d2b465e289133a5f60869f

  • Size

    7.2MB

  • Sample

    231220-ekqr8sbaeq

  • MD5

    15d7fdda9dd8ad83c24137e8679b3281

  • SHA1

    f0fb7702219964e1867699c45a1d009409cc465f

  • SHA256

    824fd338bc6728c891cde35ab8cb77c268b60ed291d2b465e289133a5f60869f

  • SHA512

    d51f86029710f02ea50e509c411b70f5368561ea0e67c6372dbc67c417526f6907e1cc35cc2f8c62b2940e9d0e66a06b05f314550a0295b9dac873fb41e0c5f5

  • SSDEEP

    196608:UZ82ycSjyviRe37EmD86Rn4Tzc8ihqQXCubLDaADXq:UZATjyp3tDLn43c8iyKLDc

Malware Config

Targets

    • Target

      824fd338bc6728c891cde35ab8cb77c268b60ed291d2b465e289133a5f60869f

    • Size

      7.2MB

    • MD5

      15d7fdda9dd8ad83c24137e8679b3281

    • SHA1

      f0fb7702219964e1867699c45a1d009409cc465f

    • SHA256

      824fd338bc6728c891cde35ab8cb77c268b60ed291d2b465e289133a5f60869f

    • SHA512

      d51f86029710f02ea50e509c411b70f5368561ea0e67c6372dbc67c417526f6907e1cc35cc2f8c62b2940e9d0e66a06b05f314550a0295b9dac873fb41e0c5f5

    • SSDEEP

      196608:UZ82ycSjyviRe37EmD86Rn4Tzc8ihqQXCubLDaADXq:UZATjyp3tDLn43c8iyKLDc

    • Hydra

      Android banker and info stealer.

    • Hydra payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

MITRE ATT&CK Enterprise v15

Tasks