Analysis
-
max time kernel
149s -
max time network
138s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
29-01-2024 16:18
General
-
Target
804a18c229614c92d0be806056ff8fe6.apk
-
Size
3.2MB
-
MD5
804a18c229614c92d0be806056ff8fe6
-
SHA1
c91f728bed9faa15223744e3e8bb859d9c6f624a
-
SHA256
45598745a90bac7335e21583bb5ee09e72a5beb47ab1d45f0ba3fdd0ddf2868b
-
SHA512
d4f6d44b9068216606a823e8f210b490d2045c95e40118fbe50fb347089d04694824c516a940ea0420f8f7c936c9d6bc35c4b7a56a2f33055031f32e800e1737
-
SSDEEP
98304:xEGhv1Jw1viCDMe0Y+0ivDDTrXDwufSQ3W38:x1h9JwhID3nfb3R
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.klfcspao.mqiahbd1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.klfcspao.mqiahbd/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.klfcspao.mqiahbd/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5601b246f6f001424b1eaeed72f5da461
SHA10f3171df201ecee15ac7e28c537c6bd3d5a4331c
SHA25676944e5e47149063360ac674e1e4ba78e904e2c8ba3aaf5fd7138c1de683bb8e
SHA512a4750e8b83cb88b0b42209b453a8254d67cd42c59d50d7b5a0795c2f7ae0f3ae386c997a46732e69873be015932fb8e14deb9d485776864e015619c67ea79393
-
Filesize
902KB
MD5ac819d70583ee9a26e9ba6a7142c7941
SHA14dc8bb405ff43b5523e66bea41d8481011339f76
SHA256d9301f48b80b519f021de79de71fea9207bc5cadb900121ac1b94e307b5a312c
SHA5122c95c3da9fe634d57c3bac84a3ab7128a499fc5a51dc9e6038274325c43b2b655dec9e4173660e4791405924d83147ca26ff70490ab3424f3184ed1a9fd6bdd9
-
Filesize
902KB
MD5135838d0eda1bbaa4150b05b19e65974
SHA1680c865108d3f9288985392c44bb79bc72df932b
SHA256070ae356eaa1e51f4cf16969f62286db8552f93c987d9a7db976f985d5e50aa8
SHA5124cecd4575738dbb0d012db66deb6ec08748425d0567d160168325e55bff0dc7248196c049224fe5f25dc9d6e9c14accccfac497c8d157e8832e64983ccbc54fe