Analysis
-
max time kernel
3470259s -
max time network
139s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
30/12/2023, 12:10
General
-
Target
181c5b246238ce6dd468dde332a33212.apk
-
Size
2.8MB
-
MD5
181c5b246238ce6dd468dde332a33212
-
SHA1
efda29b74d3217a71574998741fa6705fe94f83e
-
SHA256
7816da4e76ac01e372b8ffa022e13457b6202f3db0984a6235a894eae4f72bd4
-
SHA512
edc2436f0793c4db477d079f82b4df142ce59a3a959efea6fe1614c118c182fb8896508ad17932a04059bd1647376017c19ff3869026a2df9c8d4af334659ad7
-
SSDEEP
49152:JqfI9BGcQMHuysxApPONxwJur2TicdtfAq5WtsyHaucV1dtX1Oi6kds9IqodYeW7:JqfI9B75sypPOFrBYpAqk17czrX1IkdS
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.jvxyxzzu.ybkrznc1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jvxyxzzu.ybkrznc/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.jvxyxzzu.ybkrznc/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
343KB
MD5dfa2e48ea2a098baf32552b99ee4adf1
SHA1f111a80374f4b6cc99746564241467d3fe9b434a
SHA2564f49792434285f84610530ae160cfaf1d14f3b0a0cb26240d5c8de7a90083bda
SHA5129fe5a87f3c7a4548b3ea25fe876ca10c30009e0efd02f0d27939761af99fbfc5e0a63b0df26c187f38f4c5ac633b6d97242dd732fd671cac25aaf21759a2c742
-
Filesize
817KB
MD520f779fb9e2c0cd6733ecd3a01b47d9b
SHA1814c6d5d3fa144433cebbeddcef9510a6fde2876
SHA25691ea603bbdaac4ab5cda5b9d1308448254f10590fe7bdee05619b5570afee1dd
SHA512e9c0816a42406b372aa63b1cf971217b5cc959eb6342a2b83925ba67c0cf4d0ac124fc5fd67229fbfd6a98de2def81ff025960230e3effd248fe7029bfe29172
-
Filesize
817KB
MD574e0841db93ee2de49fbed0632f74784
SHA1abcdae1c558232c5f2ea69c95e0e2181cdbea2b9
SHA2569b36edf90f9d61a20d226b6cd3f7c3f2bb93ea4e627c19ef63e5ce0c7bad4752
SHA512de24c9cf79406c8e1d4a359a34e4ea7d114e47546ca835f503491f7689847da3a9639668896dca16c35aa564b072d6162993500f264d34ea81c54df26d8cfeda