Analysis
-
max time kernel
2582590s -
max time network
147s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
23-12-2023 18:09
Behavioral task
behavioral1
Sample
61e49ea8ac3572e344c27742a2d53266df15266d0163470bbb56e5cd7ad78a4b.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
61e49ea8ac3572e344c27742a2d53266df15266d0163470bbb56e5cd7ad78a4b.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
61e49ea8ac3572e344c27742a2d53266df15266d0163470bbb56e5cd7ad78a4b.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
61e49ea8ac3572e344c27742a2d53266df15266d0163470bbb56e5cd7ad78a4b.apk
-
Size
7.7MB
-
MD5
86a3403d7a9b5a70b5ab1074e6faea47
-
SHA1
eed67e0b464ff00aa14e9122d618bf063f2156e5
-
SHA256
61e49ea8ac3572e344c27742a2d53266df15266d0163470bbb56e5cd7ad78a4b
-
SHA512
91b516f4cf76cd77c2e333506ce320ab1f6645c67d31b18a6e67c208831bb5870de05aacfd0834457c9418b5067bbc17f53a8e9afe5d274d05e31c389bd75f27
-
SSDEEP
196608:LKWKndNMyQI4/FVjt/NMC1NC3lDWx0RiQdyjynFAL9z:OWKdNMyQfNVjMzWabyj40z
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
wdc.rejg9r45.lzeg9rjdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId wdc.rejg9r45.lzeg9rj Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId wdc.rejg9r45.lzeg9rj -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
wdc.rejg9r45.lzeg9rjioc pid process /data/user/0/wdc.rejg9r45.lzeg9rj/app_apkprotector_dex/aLQPicJi.fz 4521 wdc.rejg9r45.lzeg9rj /data/user/0/wdc.rejg9r45.lzeg9rj/app_apkprotector_dex/aLQPicJi.fz 4521 wdc.rejg9r45.lzeg9rj -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 ip-api.com -
Reads information about phone network operator.
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD56daf0ba8a01bdb1ac1093231fc142599
SHA1412760de318990a8c4800d949915f252b6ae5fb7
SHA256d053acdadd284d12846d31478fdd2f8f6e6c9e532d04c1398aa1f48000b93af8
SHA512a2aea656271e811f03cf1337ec23cfa73ab25d2858f4f7f9a59554bd41a4d2e17e6678176617bb4cdd541496a63ff1eb2c9933ecc2e00d447201ebe891c8549c
-
Filesize
3.7MB
MD556448dccfc5e741906a3f341a8074529
SHA125b37c288294286857068096f08fcaabe5f0d15c
SHA2565cbe8700ccfc399187ca8fa571a25247e60d9e0dba8ad885c414f1a572720482
SHA5121e83161e5472b11df0ba39ac094be877157e06fb6d52044cfafb7d902a67c9de0ef9dcc49423ab2f1dac7011fd99e6d65e6f505a3c8a82b864820de0ca264592
-
Filesize
336B
MD532d528f3a74b2ae9240d83470f675d19
SHA10c8a08da3dca19d3a8700856f6782f400d685938
SHA25626f162857107e648e9e2c6ca68239f09152ce0b2c82523cb81d72e4001331e0a
SHA512026cab77f5c6b217f68abc58ec87fc96ee597090ccb6f17d07aed44a2c1b6b9fef1e300a095517e160ebc1d4a397e3b0caa13a8598c972c8486a2f3af0895ea4