Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    29-01-2024 20:41

General

  • Target

    80d0ea203dd51b7689349cee6e0d2e88.apk

  • Size

    2.8MB

  • MD5

    80d0ea203dd51b7689349cee6e0d2e88

  • SHA1

    8f160183896f65aa9b1524382279448f1010d021

  • SHA256

    6253cac300eabed08691f1dd70f93ce86513ce98d2a577007efa0cb3a2560aa5

  • SHA512

    b2588300626f774d150af1a0e4ed3cd58212b23e6b75e5e5347a9b2d766d14810d00b27f26e1d85c5e1e28b01d226dfd20c2d9a817b37b879f10bb38e25307ea

  • SSDEEP

    49152:Bof2rk87VX1tdj5fsUMwVGq/ko/xnpk7EkPWUpSxk5M91dtXJCGOMhQTBbJhl9Ia:BoUD7VX1TjFRMnek+npk1PzpwkSrrXJ4

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.dhmqdmkq.ibjtwkn
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    PID:4250
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dhmqdmkq.ibjtwkn/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.dhmqdmkq.ibjtwkn/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4277

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.dhmqdmkq.ibjtwkn/code_cache/secondary-dexes/tmp-base.apk.classes1313571135756387334.zip

    Filesize

    343KB

    MD5

    d04213bd005e577075cb561ca64b34f1

    SHA1

    a01525df2f6aa5a4eef94dba46fce6ccf8497633

    SHA256

    068012f4d68b6d3ba6d029c356b464e81ccfe012ccc53b1d2f3e7b4a41bb249e

    SHA512

    c742468c22e02b8c801fdbbeb4544a19f61feaa13c401281c582435c2df0ddf4a56447db9c983436360a6358c63c751af76169865bb79c1d3baea544b43586f5

  • /data/user/0/com.dhmqdmkq.ibjtwkn/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    817KB

    MD5

    84c237d3dc08486d50666aff562fb5b5

    SHA1

    fcb0432bd9e5bb62c65450b45056f07308188aa2

    SHA256

    262b856fcb60d575480c6cd0020153f5a4b2b03ca036f9abb25bef45b93be366

    SHA512

    9377942812aae39aa27a174d5ec53bf2e13ab4355fd0b8a52d00f5687f6f017ede8738eb7b74e6ac8bd9a27a8cd557ba4fa881fce34b0f3b2177599a9146e049

  • /data/user/0/com.dhmqdmkq.ibjtwkn/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    817KB

    MD5

    3d0f6518a0fd4d068283d6822177d144

    SHA1

    0b7122cf891bf804f161aa40dca2e44bc044bedd

    SHA256

    c558cd6e6c71cbe0c7082bca2617da1d49f1e3323345b729cf33a8072995de09

    SHA512

    2ec557cca2873125f4969ec716bd23090150fc6aef344f430519edbf1eef96f959180f5148771ad6f1f747c193316fc25413f915473571ee8bb2d9de8b67ef9c