Analysis
-
max time kernel
2350575s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 04:13
General
-
Target
83380ae57698d2b13e0773969c68e2ea32d02ff1955be0f865cfaace62cf1917.apk
-
Size
6.9MB
-
MD5
09c03c318ab6a1b5f201f81480de022f
-
SHA1
01b01d29b8b62e8152438740f8956c8a0ab730a4
-
SHA256
83380ae57698d2b13e0773969c68e2ea32d02ff1955be0f865cfaace62cf1917
-
SHA512
52ae7f63a3b91fc681f77aad31e2cde23c916394c77c354c0913ec32415847887dad8e16069a6d1036aa3c678e23922cef2d76ef6feb10b70458af6534827ce9
-
SSDEEP
196608:GM6ePkMV3JKPaCalpxnz2A55eHKMeW2aNyeyrMhGyNL:GM5Pp5KSCaNnz9aK8G2L
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.rhwnanvo.prupgwg1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.rhwnanvo.prupgwg/yyitdFkqjU/Tojg7gIyjfFf7ke/base.apk.w8jqGoI1.gu8Filesize
7.4MB
MD5cc32b7410f7250c0f9afeed4a489a427
SHA1811455f73cc9aa0c4a1cbafc94d936001297a623
SHA2568c59a4d341dd808acb09ec04793a6b37b0e516e9c19bc592df67d159829a9eab
SHA5120f9e2498f656485f87d074379080c7146b2cae87d8bd313d18a279557a2234e6e63e5d2ff8019d52f186dbb15fb3405da0aa6e39d26954c7bcd091bac5d1f3b8
-
/data/user/0/com.rhwnanvo.prupgwg/yyitdFkqjU/Tojg7gIyjfFf7ke/tmp-base.apk.w8jqGoI3882912557799955294.gu8Filesize
1.1MB
MD5bb84117d3111b5fb5b48b2bf2931398a
SHA110f43669768083cd7454fa97403753676438c795
SHA25677d076fe3e9304c82e0148d4660eae2f0dcb4eaf6e75fbe441b8f01bbd820130
SHA512f6fdda7d7989e34aa1084484367548fd6cd4d96b96ca7f0b71587d801e093bb841a977b5a7b2cb11acd76fb8b7ad3e1a2ef76150cfa72c2a33378eeb34f99515