General

  • Target

    c393f0f03013dc249481462e58fa90c2cec561dc5cf4f9687930d1da8460bcbc

  • Size

    4.9MB

  • Sample

    231224-dmmmxsebcl

  • MD5

    43245acd2bfc4fb651961933a72da0ad

  • SHA1

    37b5b34250fe930132de9c4bd9efd1b6e5f3f0fa

  • SHA256

    c393f0f03013dc249481462e58fa90c2cec561dc5cf4f9687930d1da8460bcbc

  • SHA512

    d4ea92b758dcecba74309f31d17d54a1e9c9d4e2e3efafe6b05e3028d85f87fb501c90b1d3d9836c2bfa8362edd913f641efd0176d79fcd61fb15d4247eb6667

  • SSDEEP

    98304:4biNUPZ3rWOyLmQ0HA6aKoguzonco58+/dSisczzOj:4uePZ3LQF6OgQoncY8+/dVsczz+

Malware Config

Targets

    • Target

      c393f0f03013dc249481462e58fa90c2cec561dc5cf4f9687930d1da8460bcbc

    • Size

      4.9MB

    • MD5

      43245acd2bfc4fb651961933a72da0ad

    • SHA1

      37b5b34250fe930132de9c4bd9efd1b6e5f3f0fa

    • SHA256

      c393f0f03013dc249481462e58fa90c2cec561dc5cf4f9687930d1da8460bcbc

    • SHA512

      d4ea92b758dcecba74309f31d17d54a1e9c9d4e2e3efafe6b05e3028d85f87fb501c90b1d3d9836c2bfa8362edd913f641efd0176d79fcd61fb15d4247eb6667

    • SSDEEP

      98304:4biNUPZ3rWOyLmQ0HA6aKoguzonco58+/dSisczzOj:4uePZ3LQF6OgQoncY8+/dVsczz+

    • Hydra

      Android banker and info stealer.

    • Hydra payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks