Analysis
-
max time kernel
149s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
03-02-2024 09:10
General
-
Target
8bf2f3ac90a9c00855cbbdff2c3a0f28.apk
-
Size
3.3MB
-
MD5
8bf2f3ac90a9c00855cbbdff2c3a0f28
-
SHA1
ae11797c3d9fa9d5b4d9b9fd74fda79e557ea82a
-
SHA256
b16b3243bc9a93df147b1a8e08e94800282a7eadf76269424ee890241e842401
-
SHA512
acec0ef3b57a9bdc2b61259384ad6462c0f280ea10f8bd5f413d10b0a62b746933f886c94a7ff18a45b634f1a061c9ad68dedbedc792ad008d876bfc928db3c8
-
SSDEEP
98304:jxQVFvoFpultVMzLKXOQ+sSHO5WcROBCk6Pn:jxsFvZltKaXOJrHOAcRXn
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.wlfuzvxs.ojrcbuf1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wlfuzvxs.ojrcbuf/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.wlfuzvxs.ojrcbuf/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5ade01be4e8c5090e09dddbf8782a14b7
SHA1d9203892ac1552a62ae3407d067f902e9379abf1
SHA2560599c4858f6eafc4bf9702e7f31e2d83dbbcaf4b07b59679dc356878ecbe6293
SHA5129377f04f580a2788d3152ac1289a9f332a8a7a0fbcbf1bffb61c853538fc4c27d286a5b756a66c9b284327a4c2a3e966f001ae435825f81abf4791d154d038f2
-
Filesize
902KB
MD5f9844931ca6359f1dbb4b2f81b2ebc5b
SHA145fe65e1973287e9bc06cbffa0428bbc541bbf1d
SHA256ce85cb5a04d2588619eedc3934cc6737ebf5e8b9bcb3b5eec537a83a9c962c17
SHA512a7c48bafbc3a657cfc1105b2cc4e5251a4ff0a8195d2481b1021253456fac8d68a88adbf4d368ae05e3aa5a3bb96a4833e830807730257b9e2be7d8200ba5294
-
Filesize
902KB
MD538cb88e21fd48d18757977dc01124820
SHA17b9dc57ec4b81b4836b2b6b084cbf0afbf89addf
SHA256a623e3ffde4380dc86d23bddc026eca1bae7908f4e75e273f4b9d0b618f73225
SHA5124895e918883da7e17db4e5ffe4b2c5bf516e8175e1c15fa04c97ae46d5b38b8a965e1a04ccd24a6bbed67bc09025371b3cdc213a0f2b4a351eeef57ec19a308d