Analysis
-
max time kernel
3470271s -
max time network
154s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
30-12-2023 12:10
General
-
Target
181c5b246238ce6dd468dde332a33212.apk
-
Size
2.8MB
-
MD5
181c5b246238ce6dd468dde332a33212
-
SHA1
efda29b74d3217a71574998741fa6705fe94f83e
-
SHA256
7816da4e76ac01e372b8ffa022e13457b6202f3db0984a6235a894eae4f72bd4
-
SHA512
edc2436f0793c4db477d079f82b4df142ce59a3a959efea6fe1614c118c182fb8896508ad17932a04059bd1647376017c19ff3869026a2df9c8d4af334659ad7
-
SSDEEP
49152:JqfI9BGcQMHuysxApPONxwJur2TicdtfAq5WtsyHaucV1dtX1Oi6kds9IqodYeW7:JqfI9B75sypPOFrBYpAqk17czrX1IkdS
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.jvxyxzzu.ybkrznc1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
343KB
MD5dfa2e48ea2a098baf32552b99ee4adf1
SHA1f111a80374f4b6cc99746564241467d3fe9b434a
SHA2564f49792434285f84610530ae160cfaf1d14f3b0a0cb26240d5c8de7a90083bda
SHA5129fe5a87f3c7a4548b3ea25fe876ca10c30009e0efd02f0d27939761af99fbfc5e0a63b0df26c187f38f4c5ac633b6d97242dd732fd671cac25aaf21759a2c742
-
Filesize
817KB
MD574e0841db93ee2de49fbed0632f74784
SHA1abcdae1c558232c5f2ea69c95e0e2181cdbea2b9
SHA2569b36edf90f9d61a20d226b6cd3f7c3f2bb93ea4e627c19ef63e5ce0c7bad4752
SHA512de24c9cf79406c8e1d4a359a34e4ea7d114e47546ca835f503491f7689847da3a9639668896dca16c35aa564b072d6162993500f264d34ea81c54df26d8cfeda