Analysis

  • max time kernel
    4251656s
  • max time network
    144s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    12-01-2024 11:22

General

  • Target

    56520eabdbd97a436868305176e2d1ba.apk

  • Size

    3.0MB

  • MD5

    56520eabdbd97a436868305176e2d1ba

  • SHA1

    08fbc7b29cd3e9b414e81ca65b4c51ef2cf77825

  • SHA256

    1c2695d5314b46ab77ff6ea879318161310d792f4e5339926bb0aa5dd5421bf6

  • SHA512

    b8d84cded022bf776b9939aa3abd868eca6c4f6f532a9de2ce1e99c35e33445c519b22f0a1ee90674145371d720c67de8430d208811c936b420171ea9bcf74de

  • SSDEEP

    49152:8/7yT/hx1qoB+bpbwdXe/w1arsCIauzN5t9PYUMf5MK28V4D9zwfsKt5Mt:8/+/DY++bp8dXe/w4sWCNRPYpHn0zwUF

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.drddfwrl.ajwqenv
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    PID:5061

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.drddfwrl.ajwqenv/code_cache/secondary-dexes/tmp-base.apk.classes6892357820060014431.zip

    Filesize

    377KB

    MD5

    feba471a01c75d3b42892801d574979f

    SHA1

    10e5da7cafb8f02ca79f49de3b269fba698612a3

    SHA256

    37bef7b3dea0d47ac0373a98c985dd02aa39478c137a436c8f5231b020e7ffcb

    SHA512

    a143f491a1da236c402a83180072357fcd1b61d6fb362ab8969c329816518ca00c2f4bf780199a6ad7bdbe47782335eff3ce25cb7bcaa18c9063580ff258ccba

  • /data/user/0/com.drddfwrl.ajwqenv/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    902KB

    MD5

    193858a3fddc4d48cde97c5e23067e22

    SHA1

    49b752e85fa897a861a0c58f64fd1a5c344edfea

    SHA256

    4685cce104658324c8289cab13703ab8184209a54858cec8ba78d1738ab3a7f1

    SHA512

    3da7831ff1277464f26dcba3fd08c9a2c9e22e7637af8422d8c1c0bf362ae4dea939453761c03d12d9973edd7fb49563e1970ff672b671b7fa39661a32fa312f