Analysis
-
max time kernel
149s -
max time network
128s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
17-03-2024 19:10
General
-
Target
d1a5c66378309b76ab1bfc4369cc6394.apk
-
Size
3.3MB
-
MD5
d1a5c66378309b76ab1bfc4369cc6394
-
SHA1
ac88ee53a0b57e88e086e91bbaf9d27a94db6b48
-
SHA256
33c1d6d89201c1edff15a2330d8db18a498bfd71421edf583dd9cf0325a3acbc
-
SHA512
72e80300202e3d0ad2d7a706d191337986d1560d4305ff1a10d33b495516c02228a7907dce7dd341250fdb67a82d21fc3f6800aa3854f8223144bdb3da935b9d
-
SSDEEP
49152:esb7wQ3ghrG8fEVI0SLvHA/a7JryCyO2V3ACcEEiXFSTb5AI5Wk+PGo0Apf:esnwNP0QvwCm3tFSHWvG5Apf
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.uihrufmi.gqixgwg1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uihrufmi.gqixgwg/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.uihrufmi.gqixgwg/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD51a1bc76adf6e2a6df9c7cc84e97ccc43
SHA1b4147514d33979999b15bd51271bae2e01453aa2
SHA256de7ab7a7109d88a9d1fd0919e04b55a5fa74ac45e9d406c9f3d542e058b13be6
SHA5127b3db7dcc51235a0a51c7d14cf5afda81c1195449781471595471e107539299c678291b95686ad2ea8e112f2430bb944cdd3c472c38a2657ec61e9fabd665fd9
-
Filesize
902KB
MD592dc695e7ce52636f327499585a81fac
SHA1d0b0a6b11bd181a956c5c0f5770f4df99428934b
SHA256e3ec61be2c6659d306a7d975b8d6d63af6eac0320d4ffd4e3a0de1742dfd4efc
SHA5121aa287e347c8fcb00d638d2897c9b1d002f980cecd27e0fb738da47ccec1c6cd0ddd6bb854c276e3c2d3b8945c2e86a511c6646f28ab643dbc6f672d0cbe19f5
-
Filesize
902KB
MD522747165eddfede206eed1b84987430b
SHA13d324c9005c79f29e3eb967aad2bfa9554c56f5e
SHA25641d1d781c4d4543cec6ef3aeae0a9c48566c46969da52f6cfac8b07e95367179
SHA512386bef0749258ac5b4b2e1d4bd64c827cdc4d1f15d6908cc134dc3e32213eafa378656afc43c56ae6ad109b205abc1b0f5d92535df8afb82527b514cf6b17cc1