Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    31-01-2024 10:08

General

  • Target

    8421a95ea4edfe3a06cb6c78db58848b.apk

  • Size

    3.0MB

  • MD5

    8421a95ea4edfe3a06cb6c78db58848b

  • SHA1

    7b31ba4b4b2b5971ddbc812689c8ac28f28bd2a8

  • SHA256

    77b51738442f4d1b388db76db05388bd358b19f21c1f663e7993f9e32a7d6278

  • SHA512

    aaccf4c3343a3c0218b62e8545baeb8f2c3ebc1401001844303bb4f3d75b45538c7a99dc01482ee79990bbfe5bedd9edc27c614931d30f5a244488acbc409bb1

  • SSDEEP

    49152:v+afhiOsnVv0VdZNg6ieo3jGkIuFMEh4X64AKdA90Y3xnb5n5UgQCVSHn:vdf9aVv0Vd7rmXIWRj90WFusV0n

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.whbjegzv.oxvzbms
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    PID:4261
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.whbjegzv.oxvzbms/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.whbjegzv.oxvzbms/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4290

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.whbjegzv.oxvzbms/code_cache/secondary-dexes/tmp-base.apk.classes236220662303715438.zip

    Filesize

    252KB

    MD5

    1d607c8e8591b9fc5a0c40f67e22d949

    SHA1

    364457ab3a1502513cf33fa913102a86e6ee1a31

    SHA256

    89c73ad676f35ebe6bb639caac347257b9a7648775002feaac5eee71de011dbe

    SHA512

    9ff9cfe6e9c546d0c07fbbedc24b024c2f8dce87b65d878749f3b4e55749ede8271ed1c90de081452507da37052f71a594d867292c6dbb5780170a49d7891093

  • /data/user/0/com.whbjegzv.oxvzbms/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    902KB

    MD5

    53a1f6a9e903d61e4ec2daea31f8ea7b

    SHA1

    8babd0a00ac3bb155a12de4fbe33224ce4f90ceb

    SHA256

    e80d747c238d4f713bb3a8782f1783495a06cd74db1bd3ce5eccb1c85c7e6bec

    SHA512

    df7afc3791849b7e2acaac66a82b2a9ef838c397ea8d7c8086c18266ad42e3b8ebf8409ae180b1f91ae8dc93921722b6de19321a2c4e3fb01913c75a23f4e1bd

  • /data/user/0/com.whbjegzv.oxvzbms/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    902KB

    MD5

    0513aa66ad0c5dbb6fb8a683718c95a0

    SHA1

    3a88fafe95ff98b03ed7135eba6e72ed621e8e8d

    SHA256

    b7ee7aabc058d6662c43d349c3768ea0952547b9b23962e1730aa434687e1f66

    SHA512

    b34ff787b9b5ac8e06e8985be95e1662b9c98f664af50355bb4fbd14a0f643d21ecef240d8e3a8fa169d9832b02acfbc53087953470a1b4a84576e272445f5f5