Analysis
-
max time kernel
2965807s -
max time network
148s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
24-12-2023 03:07
General
-
Target
c393f0f03013dc249481462e58fa90c2cec561dc5cf4f9687930d1da8460bcbc.apk
-
Size
4.9MB
-
MD5
43245acd2bfc4fb651961933a72da0ad
-
SHA1
37b5b34250fe930132de9c4bd9efd1b6e5f3f0fa
-
SHA256
c393f0f03013dc249481462e58fa90c2cec561dc5cf4f9687930d1da8460bcbc
-
SHA512
d4ea92b758dcecba74309f31d17d54a1e9c9d4e2e3efafe6b05e3028d85f87fb501c90b1d3d9836c2bfa8362edd913f641efd0176d79fcd61fb15d4247eb6667
-
SSDEEP
98304:4biNUPZ3rWOyLmQ0HA6aKoguzonco58+/dSisczzOj:4uePZ3LQF6OgQoncY8+/dVsczz+
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
legal.advice.rigid1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/legal.advice.rigid/app_DynamicOptDex/FJTIZ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/legal.advice.rigid/app_DynamicOptDex/oat/x86/FJTIZ.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD551780a527ce6ef8cdcbc1af5286392d1
SHA1505208bb443aeed0cb4ea15bf55e9df605f6784b
SHA2569eb108ee1391d7023b8cb49941ffdebc447715f596e09636b4b69bd7b0c3e7cc
SHA5126d862746a7b31aacd58b1f4682afdc66387d6a1d92fb9ef4f77d02ec9246799bb347d09cd5c560ffbc4a31e39a741733cfac242c517351dc1c039a93dd25ef7d
-
Filesize
2.9MB
MD5176b0149a0edd8497b8ce47da5bded0f
SHA1e3f6924c93e17bfb48c3f9b9c1ebcc067c355d04
SHA2564a6c409a0126c6ee43644d9f304e1676b47397d48dacb73aa14ad21489769b96
SHA512c5023df2dd812995bb006dde0c103d1885e53b6b270bb7134f315163fe227ae137f8f6737ce8f74defd1b069445897bc1f9bf4b11109bca1c73349ddded847a1
-
Filesize
557B
MD52b5fb5fa0f930a8306f74c48a39a7ca1
SHA19bc9a499521e7ea4a32cece11fac3d7a7aa32824
SHA256fb2a0b5a3662cb98dd2cda0888dddf133d7d8259a09f6a277deb753d1cce7cce
SHA512254b5fbb7417b7f79276a5a86fddb7d99fad463b5cf106be31da3559d13122e36d91096acdf3c51d12746f386e52ffa59aa9185dac18ced82bc1b3965face511
-
Filesize
2.9MB
MD582be5c0539e0d72d5c217ae8801761db
SHA194eb3ded0e414be653e1f99b46f1633d0d772a73
SHA256cf27482da72b7c677567d31304601c07760d2e3e616d20098a11d024342b7b95
SHA5129b54715231943cb43079d69dd715fafe26384a1976be290bc7730b782939ccd443476713ab92d7064e357e2880581fd484117895a01f61299216898336169dd7