Analysis
-
max time kernel
154s -
max time network
146s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
03-02-2024 09:10
General
-
Target
8bf2f3ac90a9c00855cbbdff2c3a0f28.apk
-
Size
3.3MB
-
MD5
8bf2f3ac90a9c00855cbbdff2c3a0f28
-
SHA1
ae11797c3d9fa9d5b4d9b9fd74fda79e557ea82a
-
SHA256
b16b3243bc9a93df147b1a8e08e94800282a7eadf76269424ee890241e842401
-
SHA512
acec0ef3b57a9bdc2b61259384ad6462c0f280ea10f8bd5f413d10b0a62b746933f886c94a7ff18a45b634f1a061c9ad68dedbedc792ad008d876bfc928db3c8
-
SSDEEP
98304:jxQVFvoFpultVMzLKXOQ+sSHO5WcROBCk6Pn:jxsFvZltKaXOJrHOAcRXn
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.wlfuzvxs.ojrcbuf1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
902KB
MD538cb88e21fd48d18757977dc01124820
SHA17b9dc57ec4b81b4836b2b6b084cbf0afbf89addf
SHA256a623e3ffde4380dc86d23bddc026eca1bae7908f4e75e273f4b9d0b618f73225
SHA5124895e918883da7e17db4e5ffe4b2c5bf516e8175e1c15fa04c97ae46d5b38b8a965e1a04ccd24a6bbed67bc09025371b3cdc213a0f2b4a351eeef57ec19a308d
-
Filesize
378KB
MD5ade01be4e8c5090e09dddbf8782a14b7
SHA1d9203892ac1552a62ae3407d067f902e9379abf1
SHA2560599c4858f6eafc4bf9702e7f31e2d83dbbcaf4b07b59679dc356878ecbe6293
SHA5129377f04f580a2788d3152ac1289a9f332a8a7a0fbcbf1bffb61c853538fc4c27d286a5b756a66c9b284327a4c2a3e966f001ae435825f81abf4791d154d038f2