Analysis
-
max time kernel
2818622s -
max time network
151s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
22-12-2023 02:36
General
-
Target
5402e8cd66ea098debe860ef7c915cb5.apk
-
Size
3.3MB
-
MD5
5402e8cd66ea098debe860ef7c915cb5
-
SHA1
77f25bcf33b05147ca5731c3e3fae317f0f00e25
-
SHA256
a812b9ddae471115767559606b93ec92e7149377c57ef7609867d1cf4f405a93
-
SHA512
a1f6851cd7aff86d3980b66c0fdbc5bb2d585a938a435c8e1b52778da088695bb6868e20111954bc5064cb3151d9298dd8d767db120ef22cbaeaf6f53835b79b
-
SSDEEP
98304:+4u0TfW6P/o2sgc8MSUFpq4tXgweF7Y1Bf0K:+4u0TfRS8zaAEXgweF7aBcK
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.mlqqljmn.attbtpq1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5301828ccb4b3911e930eb58bc51c837a
SHA17df2a131bcdd08602bf431421cca461c909f441c
SHA2562046cabd8564769e3457e510a64658e49515db183012ffa3e0fd115a4b494e0c
SHA512d8a859db8b1ed1b95d3edd0b57c92ae630256cbcc3bc4eddff8fbcdece66ca8b1301f8c3a3ed2cd816583b13ba2fbbb335d4f756eb0a26352ee7f2801c8d4ffc
-
Filesize
902KB
MD542a7be0d79fa2242ff2a1b5a67927d1a
SHA1333a4aaca7a2005db7ce32ad7683550acd66d521
SHA256cd1575029f5ddad0f1be96f02bdd1f8771cf3bba5d55a8c2a80f46ff5f9c76a6
SHA51245415004418afd2702aefaa11e07555a28b5be0c26130c87147022fcca83f6500ae77884681568897939e8baa2d04f6f29cd5141c26c8d5321953da17a2b77ad