Analysis

  • max time kernel
    3230235s
  • max time network
    145s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    29-12-2023 18:58

General

  • Target

    011376f46a9ce15f6871530ba02465ce.apk

  • Size

    4.8MB

  • MD5

    011376f46a9ce15f6871530ba02465ce

  • SHA1

    d94107888bdfbffcabc6ccb1608f741ee220e97e

  • SHA256

    3640f09bff39e3a943195ecac50c30017890013dadc9d8528fd2220e218f9abe

  • SHA512

    30738bad30be433c0a6b59b28b5478bb8530f54c13ac32cbb21315d7ecef1a4e742ed76683cfb071850281bdd7dfb01117f091126528b3f3f615ed88429d6a99

  • SSDEEP

    98304:6bWNylJAL3ubx87R5wA40fdQtSiUythyCmXsl4gh:6iolJAL3ubx87HwA4WfiUyth/usKgh

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • possible.stay.tank
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/possible.stay.tank/app_DynamicOptDex/oat/wuwJxr.json.cur.prof

    Filesize

    1KB

    MD5

    fc63b7017935481a391cd5f8398b06f5

    SHA1

    a8b30efe310dfdf7c7dc9c34b21aae0e5a1b5a7a

    SHA256

    9847043b03f17ca422ed2da72a33044bc2350308fdac1e1607b9d49e0835c79e

    SHA512

    6bd1bece259af44a08b2cda126e4a7eccb89c49ff1bd4b9d422303ab884ab0ccaa96669286c5f96867b1e9dbc141aeb549034e4373a062565084a674ed555dec

  • /data/data/possible.stay.tank/app_DynamicOptDex/wuwJxr.json

    Filesize

    2.8MB

    MD5

    a7bcc535e1887f642f1aa030dd525051

    SHA1

    4391a714f37fc0f3d1e790c2b26478e86fd6d983

    SHA256

    1193d375b36622985e1ed16ac530654b9eb5572e0901805fbf0d4aa0a6c9f5ab

    SHA512

    ad53263d7aa7ed228ea3d87cfed1a9a154bbe50616715dcb9ec41681645fd45a12d256bf61bb0cda052cde52806c500308ce4de274429670a359d16ca55e16f9

  • /data/data/possible.stay.tank/app_DynamicOptDex/wuwJxr.json

    Filesize

    2.8MB

    MD5

    386c9e8f49720a742a518523d4f32140

    SHA1

    c8fcf5da3d78173798297dc52f101ff908868dd4

    SHA256

    2c20eb3cc10b45bf55cdad1c01469c3ebb2341404fbc7e4c01bc4b51ab210aa3

    SHA512

    20c74e0bed28e55c71372c2c45e273c2d75fa88fd35d7afa81caffa57cba0f175408b2a68fa0dcaec87e7949ad3b90561f7b380d6af4678d12363fbb550d38b5