Analysis
-
max time kernel
3201468s -
max time network
142s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
30-12-2023 02:07
General
-
Target
0b1c0ff2a98a57fa9ced149762b8fb9c.apk
-
Size
3.0MB
-
MD5
0b1c0ff2a98a57fa9ced149762b8fb9c
-
SHA1
3b184ddb11435dcb5d3f5de724c0718d0ecfc859
-
SHA256
f3461634486f4177f1dd18f89a06ca6a8c5bdf829604c15ecda2fa51c6a88c95
-
SHA512
73f256c581cef280938a09d34ad2bd511fcec8d354d3dacb1d855ccdba15efeec97b4bdf1acd24168d57733ede7a8947b8762377f563b14c8612383838cb9963
-
SSDEEP
49152:YbuRuQUJjM9UhqBJbujHzieFSR+GFJnSyyNYN4of6zujiHWsWcHeX5KoIoE7bD:Yq4QUJc/buH64GWOrIWsWcH8t58
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.euhfotlq.fuzdajn1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.euhfotlq.fuzdajn/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.euhfotlq.fuzdajn/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD56829a0ae3f61844d0a4e57eb0df84465
SHA19b53d1a881df077e37741e5c8f6a6269a8b44801
SHA2563a7313d3aa3141b4d6c1d1dd722a7b9fd7174345879279bd6ce044917232cc3f
SHA5129bafeb54d7ca0b6146bcecc2c183cbd3d4392807c78f546027c956c19032d95e9024a091280b2099a9549863be0f5ec78b97f3e055a25f0b23b69a19c5032f59
-
Filesize
902KB
MD5a42c4fb29f810d5805fb6a267ebff6c9
SHA17f3bbf0d77febca021b2597e22eff7741088934b
SHA2561416f39f7507584c5d05604bf22dc8e4d0c0deee1dc64cb78dffb3c085809507
SHA5129224a505a6220b4bff4b21be1fc280ec0b7560289d586d6c21f70833b56c4faf1f9a3094cb8473c43a559ec36de2c43e355b0368d4ae590e182b748482d5aca0
-
Filesize
902KB
MD50caa1a0ebd20647b4dae3bf6d7f2a19a
SHA1c0ee2687bbaeb224141585058424613b19a10035
SHA256f001e05266ecae0667daafb81dd948196a342f5df1f994b14b84ef0daf091df2
SHA512b860436e0ce0ab0548129abcd23de18451719d4fe6d9228e276b1ca51658f771470379477b43442602a2dcfec08ade272143590731a37f53ff2f5c7ee4c2f91d