Analysis
-
max time kernel
154s -
max time network
152s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
05-02-2024 11:47
General
-
Target
91e93a3b47bd97744abbce5dc98330ca.apk
-
Size
3.3MB
-
MD5
91e93a3b47bd97744abbce5dc98330ca
-
SHA1
d6aac3de005d3af50a8780f1c0b3a0e5f42b672a
-
SHA256
a89c50af8a2a4d8061031f966d5b4237b0c7e52851a30a115e76df0e7dc917d5
-
SHA512
dfa0718aa4eb54c07aad488b1b911214d66caf5ac60666fbd4941f8f83c45832097987aed4cada6bed4e4a4005ea8aed74bf09441fc116d5ebb2113bc3e55a3b
-
SSDEEP
98304:wwskdTAKH/apxtB9OwDcMbW4ys/ojSiNqnAuzb+kSf:wwVx/aDtHex6lnAMlS
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.ryzrsjmu.umppsnu1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5d6b7a9ba3172ee634cffffedcbabb071
SHA18971ad4ca5af436c4ce4b1e857f509dbf72a668d
SHA2566356ec826febe313021bff4586739462c346eac9d034c5f983c93e1da7fa811d
SHA5120419efb856713a3a0abcf19ae12139419a9ee537c141837e0019028e1b36233ef5e0485d395f28c0b4b94206d9f427b19be303a98877df257f31dde5703e20e4
-
Filesize
902KB
MD5f39c9cd89641b4f65d267bfbfaf30b9f
SHA181c5a75624a54f321cb6cb104f50b69f96f6cc92
SHA256dc2aa758b72917de84a28e0d534c6e22953f3175e47e3fae14ad555cbc22e56a
SHA512f9928f76f1eb9df75f28f32c156908c576edd84fb5ed0e9c607c9fdd169db507ddb08935a4a3ed34e1d011908eb620a2c234535b29a87cd39b23ad519f8be9c9