Analysis

  • max time kernel
    3080380s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    29-12-2023 22:00

General

  • Target

    13e082e408ee870c35487ba8b2589a44a14e4048bab5b647af0e0f03075ae80a.apk

  • Size

    2.1MB

  • MD5

    0351b970d847aa86f2b2bc1fb8400cef

  • SHA1

    76d6c57c873099e6c62ad78c61df40e11a8fc26e

  • SHA256

    13e082e408ee870c35487ba8b2589a44a14e4048bab5b647af0e0f03075ae80a

  • SHA512

    99595a7704651723243cc8f2e4161b8d6c4446b57481349284c57b9d5fbc4257764e62d5ab44ac13e556085cf39634ed20f19321741c2f8fa1bb05d36e87383b

  • SSDEEP

    49152:ol2EVGP1f6qZhw2rgrpCjQavyOgA28eiEKhJqBAtCQa:C2GGd6qZh73v728eiE7BA4j

Malware Config

Extracted

Family

hydra

C2

http://ikincipansizde.net

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.sing.lens
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    PID:4915

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sing.lens/app_DynamicOptDex/ke.json

    Filesize

    1.3MB

    MD5

    d87a652ac61912354851da39fa6bfebf

    SHA1

    77b899abb35ab717d83f85952568a3b59f1fc423

    SHA256

    24d83940f74d095c3bd8d3974322e72591a722c0217e6b0a8c7e16c9076f4879

    SHA512

    64d14f6048d488470f375301cb9b18f4661d3d6f113e22eba641e019fdb2f4f2cd3a8a13dd7efab60349ec0e42617172c7ae72d771e9545f23acd1e326fa6424

  • /data/data/com.sing.lens/app_DynamicOptDex/ke.json

    Filesize

    1.3MB

    MD5

    fb9b054c2a9ff84803a09bfde298e41b

    SHA1

    3a002f2e86536e8d90fb367dc35d199a7d41b911

    SHA256

    afa271afb94a7ada5cce30289a18510f43d8d8c68209f981774b888826e03510

    SHA512

    af049dff0ead62bea37783834dc87328c5f5ea1020e9b991c905bd76dbbee671b4a0c4eac1e5ac08aaa30f1866c66c04af0f98978c16b2c1a7e698d3608de8d9

  • /data/data/com.sing.lens/app_DynamicOptDex/oat/ke.json.cur.prof

    Filesize

    1KB

    MD5

    0301bef6aea2af337a5952bf120a6e26

    SHA1

    3c412f0df0b1db61ff072ac2afb6f7fc123657d7

    SHA256

    3b0bf2a9c8621036bb86744acbb18155ea778b7320a2ced1b8107a720167a82d

    SHA512

    7e67184f9f268e511492c96c4c0f7a60a189a3ca02ad5259f2ee2276ba4bed9b1c9c654777c8d30aedc89304ae0c6d2962d9e7a729d0e28b5414e44984862fc5

  • /data/user/0/com.sing.lens/app_DynamicOptDex/ke.json

    Filesize

    3.6MB

    MD5

    82dc3c4f854a3f634ba4bee269af64ce

    SHA1

    375f4c0f649a17cfac27bc95c8cd4da69a216a1b

    SHA256

    9b7e122aa9079a64b4de201f7cb283d2cc3603d661d5c8b6d91c414dcddc7ac4

    SHA512

    507b26f7ecf849a92857ffae10f37df05433bb4a1c4483190d227cd8043e701aa6bf85e3560c30bb294d63d40e6f917ad90a50fe032dafa91f584b3dfac3430b