Overview

overview

10

Static

static

6

d1bffe0370...a7.apk

android-9-x86

10

d1bffe0370...a7.apk

android-10-x64

10

d1bffe0370...a7.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7.bin

  • Size

    4.3MB

  • Sample

    240730-1xrqys1flk

  • MD5

    4139c26388e4dc5ca08b36d103b225ea

  • SHA1

    f656e5c271fe5fed3b23d28a52a9790b2fcbd3ba

  • SHA256

    d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7

  • SHA512

    e35d2389383d027f9b3b71e5f11b3b3b245c6ce39d7b2aade9d424f3903324fd51c9bc692a5309ae2528b70c562bc366c49717b21bff2bf45fc73916f91acb09

  • SSDEEP

    98304:P10YaLxIEJ+gfScHk/xVnqBtO8ydyuFQ5AVJAz2B:PCYa1IOqcEDnktOJM5+JN

Score
10/10
hydraandroidbankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7.bin

    • Size

      4.3MB

    • MD5

      4139c26388e4dc5ca08b36d103b225ea

    • SHA1

      f656e5c271fe5fed3b23d28a52a9790b2fcbd3ba

    • SHA256

      d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7

    • SHA512

      e35d2389383d027f9b3b71e5f11b3b3b245c6ce39d7b2aade9d424f3903324fd51c9bc692a5309ae2528b70c562bc366c49717b21bff2bf45fc73916f91acb09

    • SSDEEP

      98304:P10YaLxIEJ+gfScHk/xVnqBtO8ydyuFQ5AVJAz2B:PCYa1IOqcEDnktOJM5+JN

    Score
    10/10
    hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Hydra payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Reads information about phone network operator.

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Tasks