Analysis
-
max time kernel
149s -
max time network
141s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
17-03-2024 19:10
General
-
Target
d1a5c66378309b76ab1bfc4369cc6394.apk
-
Size
3.3MB
-
MD5
d1a5c66378309b76ab1bfc4369cc6394
-
SHA1
ac88ee53a0b57e88e086e91bbaf9d27a94db6b48
-
SHA256
33c1d6d89201c1edff15a2330d8db18a498bfd71421edf583dd9cf0325a3acbc
-
SHA512
72e80300202e3d0ad2d7a706d191337986d1560d4305ff1a10d33b495516c02228a7907dce7dd341250fdb67a82d21fc3f6800aa3854f8223144bdb3da935b9d
-
SSDEEP
49152:esb7wQ3ghrG8fEVI0SLvHA/a7JryCyO2V3ACcEEiXFSTb5AI5Wk+PGo0Apf:esnwNP0QvwCm3tFSHWvG5Apf
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.uihrufmi.gqixgwg1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
902KB
MD522747165eddfede206eed1b84987430b
SHA13d324c9005c79f29e3eb967aad2bfa9554c56f5e
SHA25641d1d781c4d4543cec6ef3aeae0a9c48566c46969da52f6cfac8b07e95367179
SHA512386bef0749258ac5b4b2e1d4bd64c827cdc4d1f15d6908cc134dc3e32213eafa378656afc43c56ae6ad109b205abc1b0f5d92535df8afb82527b514cf6b17cc1
-
Filesize
378KB
MD51a1bc76adf6e2a6df9c7cc84e97ccc43
SHA1b4147514d33979999b15bd51271bae2e01453aa2
SHA256de7ab7a7109d88a9d1fd0919e04b55a5fa74ac45e9d406c9f3d542e058b13be6
SHA5127b3db7dcc51235a0a51c7d14cf5afda81c1195449781471595471e107539299c678291b95686ad2ea8e112f2430bb944cdd3c472c38a2657ec61e9fabd665fd9