Analysis
-
max time kernel
3617376s -
max time network
152s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
31-12-2023 01:55
General
-
Target
23840a61dcaa176bf27eb79bcd9ba55f.apk
-
Size
3.2MB
-
MD5
23840a61dcaa176bf27eb79bcd9ba55f
-
SHA1
8a0b23ee64e462c310108a46adb22ef2f27f8c17
-
SHA256
c4a922a3eb4ba560f413d376f3f6944e9900457ee14b06656e369b207ec644fd
-
SHA512
cdc16f0ffaa13b84c640b34210d06d48b25b4cc297b843e7d4d2ef81043dbe87aa9f407917980d5d3fde0859fc5ce80e011286563010e9784828d1e9a3be3ef6
-
SSDEEP
98304:mowD2ikvgCi16rt5qiTwVDUaLbSPrXYKXM2JU6r3W3i:mowSz5fncVDpsM2JP3N
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.jzvsgzfv.rygpynw1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5cff004c8a43825b12ef8a844bb66ac03
SHA1a27e8efccc733f98a6ecad33f240f7d588a09f01
SHA2561fab60723b58c1ca9e793247b8b18000d50acbfbbc45347835ae3e497eb67ed9
SHA512bce335ae4f0f443f1f1f9856e4d48b497b87814efff4966761cdc15466b03bffe0416a3b29fcd139ee5070e86b8efeeb107d0e2204d5358bca085a347b61659c
-
Filesize
902KB
MD52ec93f0bdcfe7658ae7cff670827bbcd
SHA190ce910e1d9610d49d69eef55c757b8bd198b637
SHA2566feb516e56ba37446e40b9bdebc87574dcd80f2f907caa8bec3992d3485b8aee
SHA512f33d019a799f74e13ba84868cf72d21e3d0bacc91d4dfc10e3a415f36829c536d7062e2861437916024cbf271f370eab5f61373f3863c8359d7526fad902efee