Analysis
-
max time kernel
2752983s -
max time network
143s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
24-12-2023 03:07
General
-
Target
c393f0f03013dc249481462e58fa90c2cec561dc5cf4f9687930d1da8460bcbc.apk
-
Size
4.9MB
-
MD5
43245acd2bfc4fb651961933a72da0ad
-
SHA1
37b5b34250fe930132de9c4bd9efd1b6e5f3f0fa
-
SHA256
c393f0f03013dc249481462e58fa90c2cec561dc5cf4f9687930d1da8460bcbc
-
SHA512
d4ea92b758dcecba74309f31d17d54a1e9c9d4e2e3efafe6b05e3028d85f87fb501c90b1d3d9836c2bfa8362edd913f641efd0176d79fcd61fb15d4247eb6667
-
SSDEEP
98304:4biNUPZ3rWOyLmQ0HA6aKoguzonco58+/dSisczzOj:4uePZ3LQF6OgQoncY8+/dVsczz+
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
legal.advice.rigid1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD551780a527ce6ef8cdcbc1af5286392d1
SHA1505208bb443aeed0cb4ea15bf55e9df605f6784b
SHA2569eb108ee1391d7023b8cb49941ffdebc447715f596e09636b4b69bd7b0c3e7cc
SHA5126d862746a7b31aacd58b1f4682afdc66387d6a1d92fb9ef4f77d02ec9246799bb347d09cd5c560ffbc4a31e39a741733cfac242c517351dc1c039a93dd25ef7d
-
Filesize
2.9MB
MD5176b0149a0edd8497b8ce47da5bded0f
SHA1e3f6924c93e17bfb48c3f9b9c1ebcc067c355d04
SHA2564a6c409a0126c6ee43644d9f304e1676b47397d48dacb73aa14ad21489769b96
SHA512c5023df2dd812995bb006dde0c103d1885e53b6b270bb7134f315163fe227ae137f8f6737ce8f74defd1b069445897bc1f9bf4b11109bca1c73349ddded847a1
-
Filesize
1KB
MD531e3d1f5c1ceacf367d47f969b36696b
SHA137b810f1d3da586b8fd755672929ecc82dc05bea
SHA256128c04caebe14348e04fa0f8180de787959d7817580b43227c0ad2e3b64ee706
SHA51232ec95c5134a99f165704575dddebc2c16e6d293c390910631b55d3e2c74232de6f20de475aa28dffb1f21c4b0811574ebfd4a43fa6d398609288e9f5335f511