Analysis
-
max time kernel
2350577s -
max time network
153s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 04:13
General
-
Target
83380ae57698d2b13e0773969c68e2ea32d02ff1955be0f865cfaace62cf1917.apk
-
Size
6.9MB
-
MD5
09c03c318ab6a1b5f201f81480de022f
-
SHA1
01b01d29b8b62e8152438740f8956c8a0ab730a4
-
SHA256
83380ae57698d2b13e0773969c68e2ea32d02ff1955be0f865cfaace62cf1917
-
SHA512
52ae7f63a3b91fc681f77aad31e2cde23c916394c77c354c0913ec32415847887dad8e16069a6d1036aa3c678e23922cef2d76ef6feb10b70458af6534827ce9
-
SSDEEP
196608:GM6ePkMV3JKPaCalpxnz2A55eHKMeW2aNyeyrMhGyNL:GM5Pp5KSCaNnz9aK8G2L
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.rhwnanvo.prupgwg1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.rhwnanvo.prupgwg/yyitdFkqjU/Tojg7gIyjfFf7ke/tmp-base.apk.w8jqGoI3591272316912337273.gu8Filesize
1.8MB
MD538645f9fb85938ddda82989512d96aa8
SHA1eae7b23f8af9d6af893c38a0740b41f2ef645ac5
SHA256f238163d21eaae3c175caf7be6643c47d29a2dbd9020d4ea9d0641afab0ccbca
SHA51268917337484ad4418791eb0679b7500a3fd0b5d45be0fc0d33abaac91a533ec8533d94dc3a6dbda4c36983c891c9ac5a95e84c27e97a318e2bbd38e42ea4d813
-
/data/user/0/com.rhwnanvo.prupgwg/yyitdFkqjU/Tojg7gIyjfFf7ke/base.apk.w8jqGoI1.gu8Filesize
7.4MB
MD5cc32b7410f7250c0f9afeed4a489a427
SHA1811455f73cc9aa0c4a1cbafc94d936001297a623
SHA2568c59a4d341dd808acb09ec04793a6b37b0e516e9c19bc592df67d159829a9eab
SHA5120f9e2498f656485f87d074379080c7146b2cae87d8bd313d18a279557a2234e6e63e5d2ff8019d52f186dbb15fb3405da0aa6e39d26954c7bcd091bac5d1f3b8