Analysis
-
max time kernel
149s -
max time network
138s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
24-01-2024 12:28
General
-
Target
723d4d2c92d5d6da8fe7c30e21a3fe01.apk
-
Size
2.6MB
-
MD5
723d4d2c92d5d6da8fe7c30e21a3fe01
-
SHA1
a898aaf26cbccc88c372c59414be88d5e3e7991a
-
SHA256
9cbdd422daf93e15b2135f0f6feebf7428eaaaba4aeaf18c12e882e67a849c89
-
SHA512
96b26e1462ba1cc02505c14ee1f54798b1f176c0a95a0564294980315038f5d2eaa02f0c558edd24fefb18dc52f20412044cecab9926b2ccba989bfc3284c895
-
SSDEEP
49152:bxNEjeXAouzDMDACtf0gx9wfZBobdydftLkvBy/54VgVFzIz+OQ:bxFpuzDJCtf0gx9wRdx6W+VeB6u
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.nvlcdjjl.yrsbiav1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nvlcdjjl.yrsbiav/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.nvlcdjjl.yrsbiav/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD57ae3b51e69fec54f7acba4f70258f3f9
SHA15debeaa3c39c58c1b1f235661bd1db9bac411811
SHA256977f6816b12424c491a9ae113872dd5509f89cd6e37750c75c13290ca8a1d98a
SHA512ae66b1457dae9813cbe82ad64fb883c36799b6e5dd1bd3b3f1efd02feb562d88eb370df88168969e00b33ae9cdfd02c3bab0080d707844322c54187ccecdbfe4
-
Filesize
902KB
MD55104645b017a03492579f9cfafe3b6c1
SHA1ac23e1fead50428ba7f5de42b1f21b622dfea5f5
SHA256108eebfcd79e7d5c01b17cbfb74e251214c8f081f401c63ccfbdf240a3b19694
SHA51212b45febc875580f9cd763e54e006a495af05dafa7fa8148572db3df5459d9fcdd2687a2dff2cc9177c7cc8180bb4eba48be879c39be4078bc2be5f5634ff3cb
-
Filesize
902KB
MD53da0adb9a845fa82f3225e07aa272895
SHA1c17f93be72857afef107e6b7e890df963c5dfa76
SHA25647712b429fa3c12ee432042830dce272a98885c8aeb5dfad6b25eaeab8d2d0fc
SHA512c47dfa2e18b08d19542411f6a15a3a0972b0446a08fc2109cc2ed69fe7bbbbf78b5b88793fbfd5ee718c7d6f77ee41b318baff82c13fa45b99c66eb1dfe6f472