Analysis
-
max time kernel
149s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
29-01-2024 01:40
General
-
Target
7e8a7091147d1514a6826b66d2aea081.apk
-
Size
3.2MB
-
MD5
7e8a7091147d1514a6826b66d2aea081
-
SHA1
0807fefad7a37c75da6bffc7fa047b7ce09feb79
-
SHA256
1a6c8a2854417027d380f9b3572c5e8ec655493fcedc7a95467a80177f6d26c8
-
SHA512
79cdf6773fd87242d693af0a9225b8c53fa06d1175293ebda263729ebbc7a6aefc17b2d8400fbf05760156bfc33c58ecc6c7993f8476229200ddd15d2d23a715
-
SSDEEP
98304:JZDpcLbfjT9Fa7G4r+myxsgjiTrXLGjA2QAi2r6k3W3c:JZlqzf9s64r+ktGjFQA5rz3x
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.dsvjvnks.bndixhl1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsvjvnks.bndixhl/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.dsvjvnks.bndixhl/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5e24dc950d6ff3f1457fe42103f2be446
SHA127e14ce4c23428ef26e9d6f6418fa8b21ccadd0a
SHA256b0231d80b0df9e6591bd8b455ddb27142692aedf3b09eeb3033a415b433ad2cf
SHA512129a2c1bf467917c65e76e96ccf0d7f4331e4f714513ffc7d636cb96ffb75e2b7ca82b0f516ba9f860e5635a9f75d3c5db02ec05e666755ef730d0013e081f34
-
Filesize
902KB
MD5c4043c38bdcf731175ece4670a97af19
SHA14356a0f8a9ef021124dc525f1823e1bd0659826a
SHA256487eae0941b3c57d4751339e883bcd43ebf216e6865cb26a2f1acf00840092f1
SHA5128d82e873868f45fee899bdb6d852dea4002a024b706ff1de69ad73e72c63e7a187fb7f4daca8a41f0563906fa9d63f9d8eddac4dd8a49fa11a8f4ac173dd036c
-
Filesize
902KB
MD548ce8f8de0d6b88c30771574772f1a47
SHA1931b7c4dbfeba0c0b812426b496d98a539565fad
SHA256add3403e89c5947e1b55bec514ab67ef08a2f9330f00285f3dfd8647da28329f
SHA512fcd3ddc7fefa42c1c4b1016560ca080b1fd813cc1dffdeac79943059f40ffd5752f0f92fa76f1b2c55b8e9c24b4caedbdd8bf67a0d077e67e5d5f2edc46937f7