Analysis
-
max time kernel
3963937s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
09-01-2024 03:27
General
-
Target
4d378b4fbf06a8d5065b4014a5be500e.apk
-
Size
3.1MB
-
MD5
4d378b4fbf06a8d5065b4014a5be500e
-
SHA1
8bbf8e73a24da31a640566ed5c54ae3803c32c4c
-
SHA256
71c5bd9ef412ea0602a910f63f4baa556719cb901dc6c8b952e7d513cb9061e1
-
SHA512
50e70ce7f1df95adffe897982488185e78a5e8b7ed78bccb41e991cdd987d431e88b7cbcabf92e87d54fc7604f3ac106eb8f4e299a0d8f011bd1c7ad94ca7599
-
SSDEEP
49152:NzjEqZRVabFZ50iXeo7+QM7L8d1WqWjkztOGQUZMbNCTSzEJlD5CWJOlh:NzjEcRVaxZ5reU+ROw0ZOH2Mbg2aJM
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.vtzwnmsy.tnfvuqs1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.vtzwnmsy.tnfvuqs/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.vtzwnmsy.tnfvuqs/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5a3e191dbe089a92dbd825728790609e9
SHA17c0bdd1cd3458801d17ea9f22f0ab300142bb600
SHA2566ea3c86d38ea493e4c1b1273476004d2333f7ea305b5226c13830db4ca8a3bd0
SHA512f9a01edc48fea02b5d3988ac143d79e02c08c6910827641f62c57b5cb1482f413e4eea45620ec07c3a50c0e426bb94229ab253f5f2656dcb306074eedfb0ed29
-
Filesize
902KB
MD51f6adcec6138bc84d587fb52c2dab579
SHA15703a91551233137d7c102ba092a03b647efdf3f
SHA256438dd1e72eb8c8eae59ef9e873e73c80cc05cc4027395b165645a99c819dbf98
SHA512a8d93cafdb4f2770a3427b7ab098167696c9441e9bd8d8e57a58b9b38ab17ef29ad5ab45ade7053ad43d2e4cf77ac5009fc28456c0b0e8cd11d9fb1cbe424481
-
Filesize
902KB
MD59a483ca96df2aea94a76e3c19fb9d411
SHA19c9ebbc27ce96ff633cae691354d3d9be7e5a4b1
SHA256f152903e9205a206f7508688522536e84f0624ce63435100fcaeb0cb761d2092
SHA51267c2f06298ae776c199a232f0d5759a3d18b77acedcc2ef623a08383be3300145738a224a40b5684d2548084043f17a68b2a4ec664d0d42025c4f242ddf0c737