Analysis
-
max time kernel
145s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
12-03-2024 13:25
General
-
Target
c37ae32cd4bcce93797535082e2080a2.apk
-
Size
3.0MB
-
MD5
c37ae32cd4bcce93797535082e2080a2
-
SHA1
ae84294f83e45c8a9180cb6a0e658181fdee62fc
-
SHA256
2b305310db25d5ac714d4e5df898fa336e0bb3b86039b42ea37762f00956b3ff
-
SHA512
6b1005ce7b3749d94126be73e926bfea988a3961a95a493bb879e3efaea93b62936a13589c063601fda32cc1403b0b9639661dfe7183bb395c6d23c431f6506e
-
SSDEEP
49152:4MZfhiOsnVv0VdpuowM1EqMz3KDH8ZEesJfZhANAZdo5R0fe5Cn5z5Fa/SPxAqw5:4Qf9aVv0Vd8JQMmDcZsfZhu6o5K44rFq
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.wefccxit.cbhxpgr1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5051babff27f407292fe1d8a5976780aa
SHA102f1814a3654684e0bf82abdd5275e1dadb2e3a1
SHA25647cc42df8062022f5576169758085ba166008827cd08a063cd4f6ecd63f6fbf8
SHA512e4e452d30ac6cf215bc2ca157f150547d684d49d27ceda9293387adc420441aac3d3e0a10efe25870328e705a14d7ce55df797c941e694a68194faecea6dcbf9
-
Filesize
902KB
MD5bfdaf3784d3f7487759eaaed9042907a
SHA184778b47fb7d80253785530b3aaef4a11ddcb8c6
SHA2561eaaf545b99745477d09f03b96a043b885a742c7d850136117337054b9673e2a
SHA5127fba3a01105a55510457e9910af3b7368b36551d1474914e8bc88e39504cfb2fd8ff7ef42c6fc0762aba9cf8bfec3ddf82ef01bc62d7b029a8114f2f4117b646