Analysis
-
max time kernel
149s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
31-01-2024 10:08
General
-
Target
8421a95ea4edfe3a06cb6c78db58848b.apk
-
Size
3.0MB
-
MD5
8421a95ea4edfe3a06cb6c78db58848b
-
SHA1
7b31ba4b4b2b5971ddbc812689c8ac28f28bd2a8
-
SHA256
77b51738442f4d1b388db76db05388bd358b19f21c1f663e7993f9e32a7d6278
-
SHA512
aaccf4c3343a3c0218b62e8545baeb8f2c3ebc1401001844303bb4f3d75b45538c7a99dc01482ee79990bbfe5bedd9edc27c614931d30f5a244488acbc409bb1
-
SSDEEP
49152:v+afhiOsnVv0VdZNg6ieo3jGkIuFMEh4X64AKdA90Y3xnb5n5UgQCVSHn:vdf9aVv0Vd7rmXIWRj90WFusV0n
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.whbjegzv.oxvzbms1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
902KB
MD50513aa66ad0c5dbb6fb8a683718c95a0
SHA13a88fafe95ff98b03ed7135eba6e72ed621e8e8d
SHA256b7ee7aabc058d6662c43d349c3768ea0952547b9b23962e1730aa434687e1f66
SHA512b34ff787b9b5ac8e06e8985be95e1662b9c98f664af50355bb4fbd14a0f643d21ecef240d8e3a8fa169d9832b02acfbc53087953470a1b4a84576e272445f5f5
-
Filesize
102KB
MD5b416ec3dbf2a67c43de642c9282680c8
SHA1b09b1e0b5bd6eb50992d7466bae95ad239c2166c
SHA256ef550efb4a8351b4103d5446bb956cb1a8cd46b09b34ea930f9df73a5769a0b6
SHA512141af484d977559052a61e3af028256e1c57f201fdf7fef8ee4c311d9ff252cb649c8a487c22f4353bc1784937fbed2e6827d56d16d942144c35192e327ec0d2