hydra | f47c788feac2cb7b395ad9b38949f29c88d01b6dd9c94dda87f2e243bb340bd3

Analysis

max time kernel
149s
max time network
132s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
01-02-2024 06:20

Target

86289bb19a917a0032891efb2db1ab0d.apk
Size

3.2MB
MD5

86289bb19a917a0032891efb2db1ab0d
SHA1

9da0b78087a74c23f7a960a343c83a2f9f5183c9
SHA256

f47c788feac2cb7b395ad9b38949f29c88d01b6dd9c94dda87f2e243bb340bd3
SHA512

0c679a87917aa29f87502895a6ba4d7567388297c2de054885702d48cfc3595106b521affb663b8809d4420b0dbeb013398621af84e2c5c201467045e01e42bb
SSDEEP

98304:WDDYmdcR1vHxNKeZ+P7y2uXV1LRpJyvrXIKnch73W3c:WD8LvH6eZ+Ty2UV1Lr8cN31

Score

10^/10

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ckygogqt.hlighrp
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ckygogqt.hlighrp

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ckygogqt.hlighrp/code_cache/secondary-dexes/base.apk.classes1.zip	4285	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ckygogqt.hlighrp/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.ckygogqt.hlighrp/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ckygogqt.hlighrp/code_cache/secondary-dexes/base.apk.classes1.zip	4258	com.ckygogqt.hlighrp

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

com.ckygogqt.hlighrp
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:4258
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ckygogqt.hlighrp/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.ckygogqt.hlighrp/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4285

/data/user/0/com.ckygogqt.hlighrp/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
902KB

MD5
4bb4c51d8517e4cf8273b5f1790c4c46

SHA1
4539bd846e417092082cb31114c9693d8e00b248

SHA256
c8a30436554d7d27969efa84aba3666483f172009af718db874a2c987ddcddbc

SHA512
5227d6f05ccc8aa3ff098131ecda109a9adb21853393d7fc384fd842e157b388a066a51c9d7f3cccba748ac01274eae244eff15da5525294b4cff3f24d5dd167

Download Submit
/data/user/0/com.ckygogqt.hlighrp/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
902KB

MD5
9e96f22213329cad93bbf14b5a7d2838

SHA1
b0a8881fc5b80c79d63fe306275b55f9230110ff

SHA256
9337b45d709ed0e8ed097f21a227e5bb1ef3eccb1b5836228b6eee3ffae7a49b

SHA512
d5ff651b1656d12a30ec683b3073a1a9b2faab4ac88d0e108cad04fabd782702c303a4e1cae1889664707aa8f7e925b8b7cba45571bb77db6815816f9aca91e2

Download Submit