General

  • Target

    9883ebd9e8537610c3ba268125e72e567c867a585218d6577b702223d3824fff

  • Size

    2.5MB

  • Sample

    231220-kt178adedk

  • MD5

    ecfdaf8c303494ec91eb27d326072e8d

  • SHA1

    66bb3945f64b46493ecf2525fb3f69dab6ea8376

  • SHA256

    9883ebd9e8537610c3ba268125e72e567c867a585218d6577b702223d3824fff

  • SHA512

    83c0e7306e3f02b8b7c38efa92eaa59323e5d2e9edff6d3fc8c811eac0da919a1b877a87503024b45d491ef6eebf5631dda2edeca4b2deb2cf7bce8f97e7beb1

  • SSDEEP

    49152:PaRkqpvITd0iIBTBcvuC7uhqI1nBXWYb+A4i29Zn+MIF9LMCFsRnYyEuz:yRkuvo09BOvHyhJ1nBXWGHHAK9QmMtE0

Malware Config

Targets

    • Target

      9883ebd9e8537610c3ba268125e72e567c867a585218d6577b702223d3824fff

    • Size

      2.5MB

    • MD5

      ecfdaf8c303494ec91eb27d326072e8d

    • SHA1

      66bb3945f64b46493ecf2525fb3f69dab6ea8376

    • SHA256

      9883ebd9e8537610c3ba268125e72e567c867a585218d6577b702223d3824fff

    • SHA512

      83c0e7306e3f02b8b7c38efa92eaa59323e5d2e9edff6d3fc8c811eac0da919a1b877a87503024b45d491ef6eebf5631dda2edeca4b2deb2cf7bce8f97e7beb1

    • SSDEEP

      49152:PaRkqpvITd0iIBTBcvuC7uhqI1nBXWYb+A4i29Zn+MIF9LMCFsRnYyEuz:yRkuvo09BOvHyhJ1nBXWGHHAK9QmMtE0

    • Hydra

      Android banker and info stealer.

    • Hydra payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks