Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    05-02-2024 11:47

General

  • Target

    91e93a3b47bd97744abbce5dc98330ca.apk

  • Size

    3.3MB

  • MD5

    91e93a3b47bd97744abbce5dc98330ca

  • SHA1

    d6aac3de005d3af50a8780f1c0b3a0e5f42b672a

  • SHA256

    a89c50af8a2a4d8061031f966d5b4237b0c7e52851a30a115e76df0e7dc917d5

  • SHA512

    dfa0718aa4eb54c07aad488b1b911214d66caf5ac60666fbd4941f8f83c45832097987aed4cada6bed4e4a4005ea8aed74bf09441fc116d5ebb2113bc3e55a3b

  • SSDEEP

    98304:wwskdTAKH/apxtB9OwDcMbW4ys/ojSiNqnAuzb+kSf:wwVx/aDtHex6lnAMlS

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.ryzrsjmu.umppsnu
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    PID:4240
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ryzrsjmu.umppsnu/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.ryzrsjmu.umppsnu/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4269

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ryzrsjmu.umppsnu/code_cache/secondary-dexes/tmp-base.apk.classes7293802020717232173.zip

    Filesize

    378KB

    MD5

    d6b7a9ba3172ee634cffffedcbabb071

    SHA1

    8971ad4ca5af436c4ce4b1e857f509dbf72a668d

    SHA256

    6356ec826febe313021bff4586739462c346eac9d034c5f983c93e1da7fa811d

    SHA512

    0419efb856713a3a0abcf19ae12139419a9ee537c141837e0019028e1b36233ef5e0485d395f28c0b4b94206d9f427b19be303a98877df257f31dde5703e20e4

  • /data/user/0/com.ryzrsjmu.umppsnu/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    902KB

    MD5

    6fe1e10591024f4e58e94115f148fb10

    SHA1

    010178fe44ea1b7943196bdd5ffe7da61965d5c3

    SHA256

    b2dc46f8b54a72e28b9bf634f6dbd50e77ed718910282148037974eca3899561

    SHA512

    09625cd81c2c5d3aabce92764ef52a5a28e815ed1b646e0a939fe2384720e2e98d6cb92725a61c8233f9dbde22b7de1236aa217b6057e896fa807e8dbbb6c0fc

  • /data/user/0/com.ryzrsjmu.umppsnu/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    902KB

    MD5

    f39c9cd89641b4f65d267bfbfaf30b9f

    SHA1

    81c5a75624a54f321cb6cb104f50b69f96f6cc92

    SHA256

    dc2aa758b72917de84a28e0d534c6e22953f3175e47e3fae14ad555cbc22e56a

    SHA512

    f9928f76f1eb9df75f28f32c156908c576edd84fb5ed0e9c607c9fdd169db507ddb08935a4a3ed34e1d011908eb620a2c234535b29a87cd39b23ad519f8be9c9