Analysis
-
max time kernel
154s -
max time network
150s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
03-02-2024 09:10
General
-
Target
8bf2f3ac90a9c00855cbbdff2c3a0f28.apk
-
Size
3.3MB
-
MD5
8bf2f3ac90a9c00855cbbdff2c3a0f28
-
SHA1
ae11797c3d9fa9d5b4d9b9fd74fda79e557ea82a
-
SHA256
b16b3243bc9a93df147b1a8e08e94800282a7eadf76269424ee890241e842401
-
SHA512
acec0ef3b57a9bdc2b61259384ad6462c0f280ea10f8bd5f413d10b0a62b746933f886c94a7ff18a45b634f1a061c9ad68dedbedc792ad008d876bfc928db3c8
-
SSDEEP
98304:jxQVFvoFpultVMzLKXOQ+sSHO5WcROBCk6Pn:jxsFvZltKaXOJrHOAcRXn
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.wlfuzvxs.ojrcbuf1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189KB
MD521fe20540877e5c3fc43b67c16c962d6
SHA1c328dcb7c72d74919fa12d1c3ced79bda40d5c51
SHA2565fa2fb4be58d1151199b3320763d51db4ef7247236757e5ec28bcd70e965aaf0
SHA51201c08560075309da9feb3af38862a79b6f0fac03051ef4c17f01b67aae8e6395ce3df67e580deb4bd0770c825c8ad572c36f1ddb32095d181f749e60b0f29431
-
Filesize
902KB
MD538cb88e21fd48d18757977dc01124820
SHA17b9dc57ec4b81b4836b2b6b084cbf0afbf89addf
SHA256a623e3ffde4380dc86d23bddc026eca1bae7908f4e75e273f4b9d0b618f73225
SHA5124895e918883da7e17db4e5ffe4b2c5bf516e8175e1c15fa04c97ae46d5b38b8a965e1a04ccd24a6bbed67bc09025371b3cdc213a0f2b4a351eeef57ec19a308d