General
-
Target
8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430.apk
-
Size
2.8MB
-
Sample
240303-rrhresbh6x
-
MD5
d1a68785559ae6b0049a2bd1798277a1
-
SHA1
8ea0706e77e57810ff1bc9073f3701772f032557
-
SHA256
8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430
-
SHA512
b4c676c19dedf7b582598bc8bc9d3bf260b3847564d7da755cf9e694abdf2ad3555da526b7ff847dcbddf75b9d1183924a29078d181b313fcec18c8b5349637a
-
SSDEEP
49152:Ucz4N3omNn0M+CGN3SPXLD8S/obeUQGkfC1T3Eb0KizuNAGq6BXk2M:LrmR0vCSC/robeZGkfk0xA1XX
Static task
static1
Behavioral task
behavioral1
Sample
8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral3
Sample
8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430.apk
Resource
android-x64-arm64-20240221-en
Malware Config
Extracted
hydra
http://lalabanda.com
Targets
-
-
Target
8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430.apk
-
Size
2.8MB
-
MD5
d1a68785559ae6b0049a2bd1798277a1
-
SHA1
8ea0706e77e57810ff1bc9073f3701772f032557
-
SHA256
8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430
-
SHA512
b4c676c19dedf7b582598bc8bc9d3bf260b3847564d7da755cf9e694abdf2ad3555da526b7ff847dcbddf75b9d1183924a29078d181b313fcec18c8b5349637a
-
SSDEEP
49152:Ucz4N3omNn0M+CGN3SPXLD8S/obeUQGkfC1T3Eb0KizuNAGq6BXk2M:LrmR0vCSC/robeZGkfk0xA1XX
-
Hydra payload
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Requests enabling of the accessibility settings.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-