Analysis
-
max time kernel
404442s -
max time network
148s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
17-01-2024 15:44
General
-
Target
62fb51c219728f90500e55b65c7a6d01.apk
-
Size
3.0MB
-
MD5
62fb51c219728f90500e55b65c7a6d01
-
SHA1
e8a874600e78886e5525aafbeb7d6284e980c169
-
SHA256
4c9b59f488b0b3dcbf725bdf5f956fb18600da0687edf728a647590cf4c6ce67
-
SHA512
1558dc6267509fc9191576c6262f124e3b3670954f16d56feebd94d503133995a0c34855de3af8d32e6b9b84df60acef8a452baed320b816c45201ecb807d816
-
SSDEEP
49152:JaGqhp1D63F6EKYEqmyiewjnKDf0JuhUTSo8+/oWb0x4puM/X97f4Jkl5I+kcW5M:JO/1wQqmyWWD0Wo88rs4cwxQJg+vcWW
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.olmrcjgx.baitjyo1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD53ed5e776ab39dd27085be28195b77c3f
SHA129a6dc39a4ad52a646c1b6dab548952311ea39b2
SHA2564ca30b14584c7b05fd94f97cf975ab21af6fd621464c883aad67325735f08f29
SHA512a9d3a3a7e93c747c1458643d371282af32bdc1219bbab638607d6c366fb016b888b05376de265f7be5aab84bfb30ddaaee9fc3e1ad9f14749681691b7e1f79f0
-
Filesize
902KB
MD53eaacfedafbbcb82897a24b295a633fd
SHA1aae577929793b2c3afacefba74fd48fa2ac8e8e0
SHA256f94fb64439fa942cee0c0e6d7917a5b28fcbc921acbab6fc609fa55a46976f11
SHA512e55c808141a6a9b29ff953e71b524b1d913dd0cae1bc6ca76b13567d324211e490de05885e1e6a0d24167666d61d074d9605c83e952b0abda7cd061a3c0493b8