Analysis
-
max time kernel
2446570s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
20-12-2023 04:13
General
-
Target
83380ae57698d2b13e0773969c68e2ea32d02ff1955be0f865cfaace62cf1917.apk
-
Size
6.9MB
-
MD5
09c03c318ab6a1b5f201f81480de022f
-
SHA1
01b01d29b8b62e8152438740f8956c8a0ab730a4
-
SHA256
83380ae57698d2b13e0773969c68e2ea32d02ff1955be0f865cfaace62cf1917
-
SHA512
52ae7f63a3b91fc681f77aad31e2cde23c916394c77c354c0913ec32415847887dad8e16069a6d1036aa3c678e23922cef2d76ef6feb10b70458af6534827ce9
-
SSDEEP
196608:GM6ePkMV3JKPaCalpxnz2A55eHKMeW2aNyeyrMhGyNL:GM5Pp5KSCaNnz9aK8G2L
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
com.rhwnanvo.prupgwg1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rhwnanvo.prupgwg/yyitdFkqjU/Tojg7gIyjfFf7ke/base.apk.w8jqGoI1.gu8 --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.rhwnanvo.prupgwg/yyitdFkqjU/Tojg7gIyjfFf7ke/oat/x86/base.apk.w8jqGoI1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD5dc9d6130799f3d3d76104df6368d3863
SHA1828e1de95494de5a84c1ef063191a8800313b81f
SHA25630e204f746082f0b826068feb0a2699aeda5874ec5678fc73c64ddbdaee3e293
SHA512ccc9233ed15a6cc612be0b056eed050072904003c585be93e5b4c9b33f1bd5919e8bb3fc9488dc48cdfbd243fb8d6fdaee7231fc930685f0d4d94412d6e17335
-
Filesize
7.4MB
MD5fbf7e186d503d98b019e02966f4de76b
SHA1699a443f7ed137ebb3d5f69feb6d12fa6b80b51d
SHA256c0a32d28aebaf6794abd205062bc096fa9c2ec5c08fecd094fbc1789b9e6722a
SHA51259681e5e21c90863b9cd59c219914c3541dc5309837e6c930f05b670eaa0f0b0780c9dca32cf2fc78ab1d8dc7e193d7a45fbe6f72a6225a89fb62afd2597be97
-
Filesize
7.4MB
MD5cc32b7410f7250c0f9afeed4a489a427
SHA1811455f73cc9aa0c4a1cbafc94d936001297a623
SHA2568c59a4d341dd808acb09ec04793a6b37b0e516e9c19bc592df67d159829a9eab
SHA5120f9e2498f656485f87d074379080c7146b2cae87d8bd313d18a279557a2234e6e63e5d2ff8019d52f186dbb15fb3405da0aa6e39d26954c7bcd091bac5d1f3b8