Analysis
-
max time kernel
2410486s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
20-12-2023 04:00
General
-
Target
824fd338bc6728c891cde35ab8cb77c268b60ed291d2b465e289133a5f60869f.apk
-
Size
7.2MB
-
MD5
15d7fdda9dd8ad83c24137e8679b3281
-
SHA1
f0fb7702219964e1867699c45a1d009409cc465f
-
SHA256
824fd338bc6728c891cde35ab8cb77c268b60ed291d2b465e289133a5f60869f
-
SHA512
d51f86029710f02ea50e509c411b70f5368561ea0e67c6372dbc67c417526f6907e1cc35cc2f8c62b2940e9d0e66a06b05f314550a0295b9dac873fb41e0c5f5
-
SSDEEP
196608:UZ82ycSjyviRe37EmD86Rn4Tzc8ihqQXCubLDaADXq:UZATjyp3tDLn43c8iyKLDc
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 4 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.trend.debate1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.trend.debate/app_DynamicOptDex/LJb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.trend.debate/app_DynamicOptDex/oat/x86/LJb.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50408c31db302046b1e22ae4af4c0a82d
SHA1791766862acc0bd9a994748d644ceb5566421874
SHA256ecb5db9fbaeec2408a3be88262d153c9ece6e60724eb0930ef1ac29ddc8263b0
SHA5120895342a30e8f54e2f0e9368336826e07503b051f3dbbe7f7e8a02f27c73299b2442e0392880944b44e4628c69d0ade702f4f79faf256c8396bc35c216677b22
-
Filesize
5.2MB
MD5958a4b570d9adcafbb8c202d0f725d17
SHA12e1619f14dd6c901bf1e4fe4f3b5f361e64a84d9
SHA256b4f06c4b9c4a3c8a4f7501337dfd96804152dc74335750689979b3a1f7f5a704
SHA512cbfa42ad0757ffa9921e854b86aec9fa6b7d1d4ac970e58742cb1cca16b18a5fba1f51a1fcdb90202d0dc89872b112ca5572347741c99b3aa5903c8f891f97f1
-
Filesize
571B
MD55cfeb2234389f52429f3e5c264904d61
SHA1f55d4cb5a6c31bb5bde923cae6dd8846f06090e0
SHA256f120e81d01affb466d874bacb9ab3bdbda06b865f0f0c8aa67a5c45e92010d6f
SHA512ebe598a85d2432f4309ac6c4bde00ff28e9a7f7560a8dede76a3ad901b8d82594cbda6c47710e6ad3e356a2c6ee7a7bf8f6e2d8b0de508959110ae5ec7243bb1
-
Filesize
5.2MB
MD590764723bb60ffc3cad2a567263ac58a
SHA11e758417cf2ef8325716641c05bc6688346bb48d
SHA2561d940fe48c1f06a56f0ed992131fc25d511c3431e8f9233630b5930107bdfc62
SHA512e609ec1266c7234bed8883acbba8a9bb5a4732637f9407065dd9972246e6a4bdc09e3c7b4cf4a53d4f1f35cb88d005edf81a43136a90fdf172b7052aacc0b8ab