Analysis
-
max time kernel
404436s -
max time network
144s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
17-01-2024 15:44
General
-
Target
62fb51c219728f90500e55b65c7a6d01.apk
-
Size
3.0MB
-
MD5
62fb51c219728f90500e55b65c7a6d01
-
SHA1
e8a874600e78886e5525aafbeb7d6284e980c169
-
SHA256
4c9b59f488b0b3dcbf725bdf5f956fb18600da0687edf728a647590cf4c6ce67
-
SHA512
1558dc6267509fc9191576c6262f124e3b3670954f16d56feebd94d503133995a0c34855de3af8d32e6b9b84df60acef8a452baed320b816c45201ecb807d816
-
SSDEEP
49152:JaGqhp1D63F6EKYEqmyiewjnKDf0JuhUTSo8+/oWb0x4puM/X97f4Jkl5I+kcW5M:JO/1wQqmyWWD0Wo88rs4cwxQJg+vcWW
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.olmrcjgx.baitjyo1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.olmrcjgx.baitjyo/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.olmrcjgx.baitjyo/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD53ed5e776ab39dd27085be28195b77c3f
SHA129a6dc39a4ad52a646c1b6dab548952311ea39b2
SHA2564ca30b14584c7b05fd94f97cf975ab21af6fd621464c883aad67325735f08f29
SHA512a9d3a3a7e93c747c1458643d371282af32bdc1219bbab638607d6c366fb016b888b05376de265f7be5aab84bfb30ddaaee9fc3e1ad9f14749681691b7e1f79f0
-
Filesize
902KB
MD5669678ddb4eb2316b3472c3304a2a010
SHA1e39713405edd2bba678f938dba77ebecf98e4d8d
SHA25655c27a0ee3051104e71627e336f4846c4484b2592b5dc9c9ec25bf199dffa94c
SHA512ee58346841b1596ba7c08bc5a8e900bdb8fa5933f162f2db500198c3fc013ba2593091889f7f498b3512e1a8c186b1ddf83bb42ae0e06edaf20b3f982d8e3f06
-
Filesize
902KB
MD53eaacfedafbbcb82897a24b295a633fd
SHA1aae577929793b2c3afacefba74fd48fa2ac8e8e0
SHA256f94fb64439fa942cee0c0e6d7917a5b28fcbc921acbab6fc609fa55a46976f11
SHA512e55c808141a6a9b29ff953e71b524b1d913dd0cae1bc6ca76b13567d324211e490de05885e1e6a0d24167666d61d074d9605c83e952b0abda7cd061a3c0493b8