Analysis
-
max time kernel
3692063s -
max time network
147s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
05-01-2024 23:55
General
-
Target
44c17995d85ed465c7578706ecefca2f.apk
-
Size
3.0MB
-
MD5
44c17995d85ed465c7578706ecefca2f
-
SHA1
f068002deee22200bcdac3cb2858f0f1534409cf
-
SHA256
bd885c9d5f15c5fb15adb2cb6c30073bbfd3ffe202b6b7918f26dcfcd652fbb7
-
SHA512
8a276d3fe9bd96944b6b02b7228958b7781d2dfb1d0560525b64c0fde20c82a48e6153f3e183999fecf22cfb874ef8feb9e4c19972f371cab6faa4e7da575b58
-
SSDEEP
49152:CU+AC9HyG9tQtYd2W2Rw/qo9VNzySmGlu4j5Wrp2qOSDGnnDR2/d:CU+99SLid7Ow/9VNzyzGlbgphdDk16
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.raqsrhyw.ikalcjd1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5650ae5e6435468d389ee4b885eb24872
SHA1f33c7679c5d72514d28bd45f1c571b0bb3f8bcfa
SHA2568479b110803afb7b520d25ea2d1f2e3002ebb844ae9e9636b73c430925258c6b
SHA512a47a9805ef5eab21299df98e7064d0b0efc9fcb15b61b92f3b9c3f85c39324eb8ced4e55f91306b6575b840975975c337ee517a0659e973d2ce5e9eff491969c
-
Filesize
902KB
MD50c377ca7441d303cb6f8912dcd7d4c40
SHA15bad945e0baf27792fbfb90f20ba24ede142a92f
SHA2564ce22594e41c9d8e1fd5b4142281dc30a63d6c21d0aa0b62d2d174ac5c4bb927
SHA5123687a6b6cb8bde23ef7cb0b3da3aa47bc5e02599cea2a12be46b9cff742dc6a40e1ba9390e868361f158e8fe17103e78ce8e0beeb6e805d7734cba2d9affc785