hydra | 3640f09bff39e3a943195ecac50c30017890013dadc9d8528fd2220e218f9abe

Analysis

max time kernel
2811219s
max time network
151s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
24-12-2023 14:31

Target

011376f46a9ce15f6871530ba02465ce.apk
Size

4.8MB
MD5

011376f46a9ce15f6871530ba02465ce
SHA1

d94107888bdfbffcabc6ccb1608f741ee220e97e
SHA256

3640f09bff39e3a943195ecac50c30017890013dadc9d8528fd2220e218f9abe
SHA512

30738bad30be433c0a6b59b28b5478bb8530f54c13ac32cbb21315d7ecef1a4e742ed76683cfb071850281bdd7dfb01117f091126528b3f3f615ed88429d6a99
SSDEEP

98304:6bWNylJAL3ubx87R5wA40fdQtSiUythyCmXsl4gh:6iolJAL3ubx87HwA4WfiUyth/usKgh

Score

10^/10

Hydra payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	family_hydra1

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

possible.stay.tank

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	possible.stay.tank
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	possible.stay.tank

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

possible.stay.tank

ioc	pid	process
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	4992	possible.stay.tank
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	4992	possible.stay.tank

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
Reads information about phone network operator.

flow	ioc
8	ip-api.com

possible.stay.tank
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:4992

/data/data/possible.stay.tank/app_DynamicOptDex/oat/wuwJxr.json.cur.prof
Filesize
1KB

MD5
985b363ce3e86781af1024e3ecc4da56

SHA1
dd7468ae5e5b2b1fbd8ea832fab686bf286b9dd6

SHA256
ce0074a12a336ca34847b02237698b4d632e3a5915afc36920ca9bf4ee64abbe

SHA512
22ce6d1eb3bb5db0f5c57ffaa36138bc1ddb5b0bb07fc14aaa13aecf6d0a4dce1407425d0f0e03ab0112d337679857488f73fdae53c89b0175440afa1efb853a

Download Submit
/data/data/possible.stay.tank/app_DynamicOptDex/wuwJxr.json
Filesize
2.8MB

MD5
a7bcc535e1887f642f1aa030dd525051

SHA1
4391a714f37fc0f3d1e790c2b26478e86fd6d983

SHA256
1193d375b36622985e1ed16ac530654b9eb5572e0901805fbf0d4aa0a6c9f5ab

SHA512
ad53263d7aa7ed228ea3d87cfed1a9a154bbe50616715dcb9ec41681645fd45a12d256bf61bb0cda052cde52806c500308ce4de274429670a359d16ca55e16f9

Download Submit
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json
Filesize
2.8MB

MD5
386c9e8f49720a742a518523d4f32140

SHA1
c8fcf5da3d78173798297dc52f101ff908868dd4

SHA256
2c20eb3cc10b45bf55cdad1c01469c3ebb2341404fbc7e4c01bc4b51ab210aa3

SHA512
20c74e0bed28e55c71372c2c45e273c2d75fa88fd35d7afa81caffa57cba0f175408b2a68fa0dcaec87e7949ad3b90561f7b380d6af4678d12363fbb550d38b5

Download Submit