Analysis
-
max time kernel
149s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
24-01-2024 03:51
General
-
Target
716003c3056c3d8483a1fb469596b7d9.apk
-
Size
3.1MB
-
MD5
716003c3056c3d8483a1fb469596b7d9
-
SHA1
cee5c812eaec44015c844718e211a162ce497f49
-
SHA256
adca984304f23557bbab99360a86e331ac018d15c9fbdbcb286c9f7ecf2f53df
-
SHA512
98b2b8149f0e5b45980e9439e1f1e01ec568048aad1bc08680be178b768b945ec230508dec4ff5d58e551c1a1958b3cd4ee6c044e4d3df8e17170be879d67954
-
SSDEEP
49152:xKq+vZPoStSYCPXc8Z4jpnauk82apEUhOVZEHcafxYx0MG0fd/D51:xgoStoMBjpnHR2apEBZWc8xYxLhX
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.wbyjkbij.oljtmmc1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wbyjkbij.oljtmmc/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.wbyjkbij.oljtmmc/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5d2a30e8ba5f1d322dd61e3144603dec3
SHA11b700898474e7c0d2844dc4f68989bb042eb70f4
SHA256fb9ae5eec454a26e1b2026a3a328e9610a8f1f76723ea10e25e2c166f4b5893e
SHA512241e6d970218013c26148981b4e3264afe79033a6d860c548ba7e0b84b76e10881b6e30f5dad97172f72c3b830044ce34d08a0ec772c240c26ef7928de1abf56
-
Filesize
902KB
MD57515b8d0da20163b9eece16d57575e8d
SHA1a52bac8c39fba2deeaedf9b8a8ed009e38fa21a1
SHA2565da5ed4ac44995469df8f4af985eb781d8126e0c2e5bb2cc368180da8450ccc6
SHA51218513986823e4e8eb957e1111aa81dbebc30c61aa64a20885777cac4b6b551182b6698a6116d54fccc23ca4c127baaa87e09585b00154624bf6b4685622e25cf
-
Filesize
902KB
MD5beb0a98b5a2345bf887ccc632e2d1500
SHA117254a6415f07fe3e4c8787d07ac00be4280a9d1
SHA25646031e5f833dbeaa0667ff37b663eb117c4135ce7b554823fe5ba4cf850eddc6
SHA512f742f16d5354682932833568bf0702178b7b2f69fc2ca7899c56d7df89bb228fc8db53eafc6e4e71519b755c4337e1a0e1ad83f2d45834a7972841f3479a77ff