Analysis
-
max time kernel
3031239s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
24-12-2023 14:31
General
-
Target
011376f46a9ce15f6871530ba02465ce.apk
-
Size
4.8MB
-
MD5
011376f46a9ce15f6871530ba02465ce
-
SHA1
d94107888bdfbffcabc6ccb1608f741ee220e97e
-
SHA256
3640f09bff39e3a943195ecac50c30017890013dadc9d8528fd2220e218f9abe
-
SHA512
30738bad30be433c0a6b59b28b5478bb8530f54c13ac32cbb21315d7ecef1a4e742ed76683cfb071850281bdd7dfb01117f091126528b3f3f615ed88429d6a99
-
SSDEEP
98304:6bWNylJAL3ubx87R5wA40fdQtSiUythyCmXsl4gh:6iolJAL3ubx87HwA4WfiUyth/usKgh
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
possible.stay.tank1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/possible.stay.tank/app_DynamicOptDex/oat/x86/wuwJxr.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
568B
MD5151d3b7fcc04080d6f62e2a0d5985fac
SHA1843c54150f92628335ff398ed37fcb6a557fbe86
SHA256eaf49e686f4e13c33eaa3e36fb55da4dbcc0124c6738121ef26eb136cb465ca6
SHA512b045b0dcca06987db2715eecff78423b8bef4c5c2ff3db5d3e2c221cac6212d5f87c9706772d83297327ada2fe64bb06644eea219bc8c6f9b778fe900a529666
-
Filesize
2.8MB
MD5386c9e8f49720a742a518523d4f32140
SHA1c8fcf5da3d78173798297dc52f101ff908868dd4
SHA2562c20eb3cc10b45bf55cdad1c01469c3ebb2341404fbc7e4c01bc4b51ab210aa3
SHA51220c74e0bed28e55c71372c2c45e273c2d75fa88fd35d7afa81caffa57cba0f175408b2a68fa0dcaec87e7949ad3b90561f7b380d6af4678d12363fbb550d38b5
-
Filesize
2.8MB
MD5d6b191cb3ff6e837c78b2c33de83014f
SHA17ba62d7fb961b896795286374f35516212cd9642
SHA256ce5f88e9dfd1cca6f890a3ce5f0f39b8855d99a3316efb45119fb4bdc22e1549
SHA512b82ff24856ff1e0d1ca30dac542d166911573d09ec6e1b1deb783429fe2d98f38d1a80f1a93a6487731c29b9ad04f874d1b3b0552833f28a4868669b11eacad1