Analysis
-
max time kernel
2811236s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
24-12-2023 14:31
General
-
Target
011376f46a9ce15f6871530ba02465ce.apk
-
Size
4.8MB
-
MD5
011376f46a9ce15f6871530ba02465ce
-
SHA1
d94107888bdfbffcabc6ccb1608f741ee220e97e
-
SHA256
3640f09bff39e3a943195ecac50c30017890013dadc9d8528fd2220e218f9abe
-
SHA512
30738bad30be433c0a6b59b28b5478bb8530f54c13ac32cbb21315d7ecef1a4e742ed76683cfb071850281bdd7dfb01117f091126528b3f3f615ed88429d6a99
-
SSDEEP
98304:6bWNylJAL3ubx87R5wA40fdQtSiUythyCmXsl4gh:6iolJAL3ubx87HwA4WfiUyth/usKgh
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
possible.stay.tank1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5a7bcc535e1887f642f1aa030dd525051
SHA14391a714f37fc0f3d1e790c2b26478e86fd6d983
SHA2561193d375b36622985e1ed16ac530654b9eb5572e0901805fbf0d4aa0a6c9f5ab
SHA512ad53263d7aa7ed228ea3d87cfed1a9a154bbe50616715dcb9ec41681645fd45a12d256bf61bb0cda052cde52806c500308ce4de274429670a359d16ca55e16f9
-
Filesize
2.8MB
MD5386c9e8f49720a742a518523d4f32140
SHA1c8fcf5da3d78173798297dc52f101ff908868dd4
SHA2562c20eb3cc10b45bf55cdad1c01469c3ebb2341404fbc7e4c01bc4b51ab210aa3
SHA51220c74e0bed28e55c71372c2c45e273c2d75fa88fd35d7afa81caffa57cba0f175408b2a68fa0dcaec87e7949ad3b90561f7b380d6af4678d12363fbb550d38b5