Analysis
-
max time kernel
3963941s -
max time network
142s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
09-01-2024 03:27
General
-
Target
4d378b4fbf06a8d5065b4014a5be500e.apk
-
Size
3.1MB
-
MD5
4d378b4fbf06a8d5065b4014a5be500e
-
SHA1
8bbf8e73a24da31a640566ed5c54ae3803c32c4c
-
SHA256
71c5bd9ef412ea0602a910f63f4baa556719cb901dc6c8b952e7d513cb9061e1
-
SHA512
50e70ce7f1df95adffe897982488185e78a5e8b7ed78bccb41e991cdd987d431e88b7cbcabf92e87d54fc7604f3ac106eb8f4e299a0d8f011bd1c7ad94ca7599
-
SSDEEP
49152:NzjEqZRVabFZ50iXeo7+QM7L8d1WqWjkztOGQUZMbNCTSzEJlD5CWJOlh:NzjEcRVaxZ5reU+ROw0ZOH2Mbg2aJM
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.vtzwnmsy.tnfvuqs1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD513fe824b034f033c8b1bbce59c148061
SHA1f64ddf99a307194a97096e2a19b69c2e4873e39f
SHA256dcbadb2b0fc4beec3fc2f4e35353b11f4fa655353fd5a3bd373a924aa4b6b148
SHA512006a92abbc2d6ead2079d6289ae03a6b340ab032525de1ba984289605df4eb1c34201b71100fa1a964a79342deb6416fcf47a0a90b35f804c440c1f5570427ab
-
Filesize
902KB
MD59a483ca96df2aea94a76e3c19fb9d411
SHA19c9ebbc27ce96ff633cae691354d3d9be7e5a4b1
SHA256f152903e9205a206f7508688522536e84f0624ce63435100fcaeb0cb761d2092
SHA51267c2f06298ae776c199a232f0d5759a3d18b77acedcc2ef623a08383be3300145738a224a40b5684d2548084043f17a68b2a4ec664d0d42025c4f242ddf0c737