Analysis
-
max time kernel
3692097s -
max time network
136s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
05-01-2024 23:55
General
-
Target
44c17995d85ed465c7578706ecefca2f.apk
-
Size
3.0MB
-
MD5
44c17995d85ed465c7578706ecefca2f
-
SHA1
f068002deee22200bcdac3cb2858f0f1534409cf
-
SHA256
bd885c9d5f15c5fb15adb2cb6c30073bbfd3ffe202b6b7918f26dcfcd652fbb7
-
SHA512
8a276d3fe9bd96944b6b02b7228958b7781d2dfb1d0560525b64c0fde20c82a48e6153f3e183999fecf22cfb874ef8feb9e4c19972f371cab6faa4e7da575b58
-
SSDEEP
49152:CU+AC9HyG9tQtYd2W2Rw/qo9VNzySmGlu4j5Wrp2qOSDGnnDR2/d:CU+99SLid7Ow/9VNzyzGlbgphdDk16
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.raqsrhyw.ikalcjd1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.raqsrhyw.ikalcjd/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.raqsrhyw.ikalcjd/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253KB
MD5f7c82db9993510160927669beab63805
SHA15a6e40bb41fe56c42e821100cc15850347796f89
SHA256239f7cd9a0d4661eb4f0167f1550f3caf07ae3538debc95a2616ed74d7a172ec
SHA5128a1661b447843c8c73c5f722f5357353295041c5486d8c03a316be9acd25e4f0e00990c5dd770eca3c9e8eb291f9e2375bd3fdb79252bff4dc99ff77a529fd84
-
Filesize
902KB
MD51c35eb4a68e181887d02962ef8a6191e
SHA16539e5d5ad0c9ea709c97d5485343c017f8c7be6
SHA256f7ea077a44c9df28722fbd89df781aea273d7d50bd7cb655781eb6a82479c1b7
SHA512c1d11c94f0c9b9f5500244f54591eb41e194e00bfab97c3c3bcbf50ecc8b9a539c647d4fae6f9ef61d8d36d3623903f8e5d63fd7deb6b622a0632e205327c481
-
Filesize
902KB
MD50c377ca7441d303cb6f8912dcd7d4c40
SHA15bad945e0baf27792fbfb90f20ba24ede142a92f
SHA2564ce22594e41c9d8e1fd5b4142281dc30a63d6c21d0aa0b62d2d174ac5c4bb927
SHA5123687a6b6cb8bde23ef7cb0b3da3aa47bc5e02599cea2a12be46b9cff742dc6a40e1ba9390e868361f158e8fe17103e78ce8e0beeb6e805d7734cba2d9affc785