Overview

overview

10

Static

static

6

4de47a1a6c...02.apk

android-9-x86

10

4de47a1a6c...02.apk

android-10-x64

10

4de47a1a6c...02.apk

android-11-x64

10

Analysis

  • max time kernel
    3398322s
  • max time network
    140s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231215-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
  • submitted
    26-12-2023 02:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4de47a1a6c0db896371ea6d7c3826e02.apk

  • Size

    7.5MB

  • MD5

    4de47a1a6c0db896371ea6d7c3826e02

  • SHA1

    0bd2c907249f9abcf86bba8b853247335db51a2b

  • SHA256

    3eba7728425ff722be181f04703abc8e4f4972be4ee0a16dbd904ec12f0aeaec

  • SHA512

    947dafb8fd89bbe98e148ffe40c759dde245d345b7e0b9300c21c80e5ddbb76b14080d412a6a81800666988d75731a2250df5c33e8a58b235db2929a7bf1dd9a

  • SSDEEP

    196608:NJb3r1miltWPWDK9spB0W8DWx0RiQdyjynFAL9P:NJb71fMWesYWoWabyj40P

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.vdzbwmgd.rmqvvos
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    PID:4613

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.vdzbwmgd.rmqvvos/app_torfiles/geoip
    Filesize

    2.5MB

    MD5

    5c6f41ab4506e3ccb906dfd8d7898743

    SHA1

    73378c8396a50626272a5ee202d619860625ea44

    SHA256

    811d47e961ea0ffff1ace66571e40d729a21ec1d849403a971ce6efed9cf339d

    SHA512

    04518b2805b28721cbbea65e65dbe9322625e68487670f021d6ab648529b31824febef657303599b209ce6b64d661366c6c6a64ade32233eceedecdb350fd926

    Download Submit

  • /data/user/0/com.vdzbwmgd.rmqvvos/code_cache/secondary-dexes/base.apk.classes1.zip
    Filesize

    3.9MB

    MD5

    40f8ec7aa0b466de0607f5e0c8e21d51

    SHA1

    4191a9b9c60106c1f1ec34bfa512e16f7108c8ad

    SHA256

    cd900526e419949742e1e702a1402d58e960fca0e977a1ce84b7159b32e82f07

    SHA512

    cf34c8c9bd5cccd7649c39d6318151b41b87bb344bd99c76cc24a56105b355bdc99fd4402dd2a16db5adab1f10d0ded36402dc1c8ec877c4eb28ba78c7c9747c

    Download Submit

  • /data/user/0/com.vdzbwmgd.rmqvvos/code_cache/secondary-dexes/tmp-base.apk.classes737103471872214532.zip
    Filesize

    1.7MB

    MD5

    0c0d0145a168eabde32cdf9a29852ced

    SHA1

    6a8790a0347b3431857296f66937ae97416052b1

    SHA256

    95ec3104ae71a5938c05e502601b1917dfba6bbe2a6793cb8f63f5f4915d6bf8

    SHA512

    fb674f09edcf7dff5508dca68803fad63478d8fb67907472160096692d42b26ac7685367e94fabd65cc1f37857a23bbf23b24211df7acb70f19d6beaa55286e3

    Download Submit