hydra | 9ec93f30a4d4c404687abd67f4aeb19d2f50b16c7662e41aba8f86a5407ba14d

Analysis

max time kernel
2466544s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
20-12-2023 09:49

Target

9ec93f30a4d4c404687abd67f4aeb19d2f50b16c7662e41aba8f86a5407ba14d.apk
Size

2.4MB
MD5

b11e72c94d810958df65d8716d853bc3
SHA1

606a5eaf439586fc316a3befc85431091bfa786e
SHA256

9ec93f30a4d4c404687abd67f4aeb19d2f50b16c7662e41aba8f86a5407ba14d
SHA512

c18853c87af0198a0d19d097e1f83e0044d32b3d676a23dd0cd132499d098a951d31777153e6c6e9f9710b3fc28e74129173fc90b6c7ab2711a34a84ff5b98c5
SSDEEP

49152:ZxkyYHERA1iUZXObVbVIrobX57/prbB5Wk4HMIyzNZ60/KrYvTD0iXXYMZ04YKx:ZxkyYke1iiYbe0L57/ZjWJHMIyxwQKs3

Score

10^/10

Hydra payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.scare.obscure/app_DynamicOptDex/Yy.json	family_hydra1

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.scare.obscure

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.scare.obscure
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.scare.obscure

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.scare.obscure

ioc	pid	process
/data/user/0/com.scare.obscure/app_DynamicOptDex/Yy.json	4619	com.scare.obscure
/data/user/0/com.scare.obscure/app_DynamicOptDex/Yy.json	4619	com.scare.obscure

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 ip-api.com
Reads information about phone network operator.

flow	ioc
19	ip-api.com

com.scare.obscure
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:4619

/data/user/0/com.scare.obscure/app_DynamicOptDex/Yy.json
Filesize
573KB

MD5
dbdafc6c18b0b6f9a9c0252ed395c740

SHA1
d48bf669f240932e78fdb5f5d5696327af7dff72

SHA256
598ac88704fe5dc9707c34228de82bf1ea7805cfc4ca81427958694835cbb19a

SHA512
96fdec46f2c5cfae40fc636dbf0ae4ccf4b289d5b6aaaa194df287b9c52685dc56478bf9f3f7274873e06a6ee3e4ff6a67aaaef920f0f0d1f7f05010b7bf5ea9

Download Submit
/data/user/0/com.scare.obscure/app_DynamicOptDex/Yy.json
Filesize
573KB

MD5
1e11861994b5b31e4c58c224eef13532

SHA1
1f283ac3c312401df111388d1c295a975adc37f8

SHA256
75491e51cbe3aff4632b5ade80f77ce14b0ccdff422ff3c457dd5552e9693697

SHA512
3543ab0858bc0ab478c35c28d419866d556c1e5cc081416ed03ceb8f601bc99f65a97c6c537cb501b26fa3bd09a3e3d813f926df46a3f886616e40d8683717c0

Download Submit