Analysis
-
max time kernel
149s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
24-01-2024 03:51
General
-
Target
716003c3056c3d8483a1fb469596b7d9.apk
-
Size
3.1MB
-
MD5
716003c3056c3d8483a1fb469596b7d9
-
SHA1
cee5c812eaec44015c844718e211a162ce497f49
-
SHA256
adca984304f23557bbab99360a86e331ac018d15c9fbdbcb286c9f7ecf2f53df
-
SHA512
98b2b8149f0e5b45980e9439e1f1e01ec568048aad1bc08680be178b768b945ec230508dec4ff5d58e551c1a1958b3cd4ee6c044e4d3df8e17170be879d67954
-
SSDEEP
49152:xKq+vZPoStSYCPXc8Z4jpnauk82apEUhOVZEHcafxYx0MG0fd/D51:xgoStoMBjpnHR2apEBZWc8xYxLhX
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.wbyjkbij.oljtmmc1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
902KB
MD5beb0a98b5a2345bf887ccc632e2d1500
SHA117254a6415f07fe3e4c8787d07ac00be4280a9d1
SHA25646031e5f833dbeaa0667ff37b663eb117c4135ce7b554823fe5ba4cf850eddc6
SHA512f742f16d5354682932833568bf0702178b7b2f69fc2ca7899c56d7df89bb228fc8db53eafc6e4e71519b755c4337e1a0e1ad83f2d45834a7972841f3479a77ff
-
Filesize
378KB
MD5d2a30e8ba5f1d322dd61e3144603dec3
SHA11b700898474e7c0d2844dc4f68989bb042eb70f4
SHA256fb9ae5eec454a26e1b2026a3a328e9610a8f1f76723ea10e25e2c166f4b5893e
SHA512241e6d970218013c26148981b4e3264afe79033a6d860c548ba7e0b84b76e10881b6e30f5dad97172f72c3b830044ce34d08a0ec772c240c26ef7928de1abf56