Analysis
-
max time kernel
3201502s -
max time network
147s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
30-12-2023 02:07
General
-
Target
0b1c0ff2a98a57fa9ced149762b8fb9c.apk
-
Size
3.0MB
-
MD5
0b1c0ff2a98a57fa9ced149762b8fb9c
-
SHA1
3b184ddb11435dcb5d3f5de724c0718d0ecfc859
-
SHA256
f3461634486f4177f1dd18f89a06ca6a8c5bdf829604c15ecda2fa51c6a88c95
-
SHA512
73f256c581cef280938a09d34ad2bd511fcec8d354d3dacb1d855ccdba15efeec97b4bdf1acd24168d57733ede7a8947b8762377f563b14c8612383838cb9963
-
SSDEEP
49152:YbuRuQUJjM9UhqBJbujHzieFSR+GFJnSyyNYN4of6zujiHWsWcHeX5KoIoE7bD:Yq4QUJc/buH64GWOrIWsWcH8t58
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.euhfotlq.fuzdajn1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
902KB
MD50caa1a0ebd20647b4dae3bf6d7f2a19a
SHA1c0ee2687bbaeb224141585058424613b19a10035
SHA256f001e05266ecae0667daafb81dd948196a342f5df1f994b14b84ef0daf091df2
SHA512b860436e0ce0ab0548129abcd23de18451719d4fe6d9228e276b1ca51658f771470379477b43442602a2dcfec08ade272143590731a37f53ff2f5c7ee4c2f91d
-
Filesize
378KB
MD56829a0ae3f61844d0a4e57eb0df84465
SHA19b53d1a881df077e37741e5c8f6a6269a8b44801
SHA2563a7313d3aa3141b4d6c1d1dd722a7b9fd7174345879279bd6ce044917232cc3f
SHA5129bafeb54d7ca0b6146bcecc2c183cbd3d4392807c78f546027c956c19032d95e9024a091280b2099a9549863be0f5ec78b97f3e055a25f0b23b69a19c5032f59