Analysis

  • max time kernel
    154s
  • max time network
    144s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    24-01-2024 12:28

General

  • Target

    723d4d2c92d5d6da8fe7c30e21a3fe01.apk

  • Size

    2.6MB

  • MD5

    723d4d2c92d5d6da8fe7c30e21a3fe01

  • SHA1

    a898aaf26cbccc88c372c59414be88d5e3e7991a

  • SHA256

    9cbdd422daf93e15b2135f0f6feebf7428eaaaba4aeaf18c12e882e67a849c89

  • SHA512

    96b26e1462ba1cc02505c14ee1f54798b1f176c0a95a0564294980315038f5d2eaa02f0c558edd24fefb18dc52f20412044cecab9926b2ccba989bfc3284c895

  • SSDEEP

    49152:bxNEjeXAouzDMDACtf0gx9wfZBobdydftLkvBy/54VgVFzIz+OQ:bxFpuzDJCtf0gx9wRdx6W+VeB6u

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.nvlcdjjl.yrsbiav
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    PID:5063

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nvlcdjjl.yrsbiav/code_cache/secondary-dexes/tmp-base.apk.classes1260379270241689386.zip

    Filesize

    378KB

    MD5

    7ae3b51e69fec54f7acba4f70258f3f9

    SHA1

    5debeaa3c39c58c1b1f235661bd1db9bac411811

    SHA256

    977f6816b12424c491a9ae113872dd5509f89cd6e37750c75c13290ca8a1d98a

    SHA512

    ae66b1457dae9813cbe82ad64fb883c36799b6e5dd1bd3b3f1efd02feb562d88eb370df88168969e00b33ae9cdfd02c3bab0080d707844322c54187ccecdbfe4

  • /data/user/0/com.nvlcdjjl.yrsbiav/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    902KB

    MD5

    3da0adb9a845fa82f3225e07aa272895

    SHA1

    c17f93be72857afef107e6b7e890df963c5dfa76

    SHA256

    47712b429fa3c12ee432042830dce272a98885c8aeb5dfad6b25eaeab8d2d0fc

    SHA512

    c47dfa2e18b08d19542411f6a15a3a0972b0446a08fc2109cc2ed69fe7bbbbf78b5b88793fbfd5ee718c7d6f77ee41b318baff82c13fa45b99c66eb1dfe6f472