Analysis
-
max time kernel
153s -
max time network
147s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
29-01-2024 20:41
Static task
static1
Behavioral task
behavioral1
Sample
80d0ea203dd51b7689349cee6e0d2e88.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
80d0ea203dd51b7689349cee6e0d2e88.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
80d0ea203dd51b7689349cee6e0d2e88.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral4
Sample
vk_dex.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral5
Sample
vk_dex.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral6
Sample
vk_dex.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
80d0ea203dd51b7689349cee6e0d2e88.apk
-
Size
2.8MB
-
MD5
80d0ea203dd51b7689349cee6e0d2e88
-
SHA1
8f160183896f65aa9b1524382279448f1010d021
-
SHA256
6253cac300eabed08691f1dd70f93ce86513ce98d2a577007efa0cb3a2560aa5
-
SHA512
b2588300626f774d150af1a0e4ed3cd58212b23e6b75e5e5347a9b2d766d14810d00b27f26e1d85c5e1e28b01d226dfd20c2d9a817b37b879f10bb38e25307ea
-
SSDEEP
49152:Bof2rk87VX1tdj5fsUMwVGq/ko/xnpk7EkPWUpSxk5M91dtXJCGOMhQTBbJhl9Ia:BoUD7VX1TjFRMnek+npk1PzpwkSrrXJ4
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.dhmqdmkq.ibjtwkn Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.dhmqdmkq.ibjtwkn -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dhmqdmkq.ibjtwkn/code_cache/secondary-dexes/base.apk.classes1.zip 4983 com.dhmqdmkq.ibjtwkn -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Reads information about phone network operator.
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.dhmqdmkq.ibjtwkn/code_cache/secondary-dexes/tmp-base.apk.classes3756249602118544118.zip
Filesize343KB
MD5d04213bd005e577075cb561ca64b34f1
SHA1a01525df2f6aa5a4eef94dba46fce6ccf8497633
SHA256068012f4d68b6d3ba6d029c356b464e81ccfe012ccc53b1d2f3e7b4a41bb249e
SHA512c742468c22e02b8c801fdbbeb4544a19f61feaa13c401281c582435c2df0ddf4a56447db9c983436360a6358c63c751af76169865bb79c1d3baea544b43586f5
-
Filesize
817KB
MD53d0f6518a0fd4d068283d6822177d144
SHA10b7122cf891bf804f161aa40dca2e44bc044bedd
SHA256c558cd6e6c71cbe0c7082bca2617da1d49f1e3323345b729cf33a8072995de09
SHA5122ec557cca2873125f4969ec716bd23090150fc6aef344f430519edbf1eef96f959180f5148771ad6f1f747c193316fc25413f915473571ee8bb2d9de8b67ef9c