Analysis
-
max time kernel
179s -
max time network
133s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
30-07-2024 22:02
General
-
Target
d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7.apk
-
Size
4.3MB
-
MD5
4139c26388e4dc5ca08b36d103b225ea
-
SHA1
f656e5c271fe5fed3b23d28a52a9790b2fcbd3ba
-
SHA256
d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7
-
SHA512
e35d2389383d027f9b3b71e5f11b3b3b245c6ce39d7b2aade9d424f3903324fd51c9bc692a5309ae2528b70c562bc366c49717b21bff2bf45fc73916f91acb09
-
SSDEEP
98304:P10YaLxIEJ+gfScHk/xVnqBtO8ydyuFQ5AVJAz2B:PCYa1IOqcEDnktOJM5+JN
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
peace.close.visit1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/peace.close.visit/app_DynamicOptDex/coiC.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/peace.close.visit/app_DynamicOptDex/oat/x86/coiC.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD574ff72f8e4bcb5900c2a77b23de3ac08
SHA11831e0eb53a220944e34887750e80ef15f712fbd
SHA256a4264e05a0e7d5706f172e4e147ba67554746afe777ccbba42f704c568ee57e4
SHA5121df2abd8bf4592973c1ec684f1abf346fb58fdf5fb1cb74034bf8917474c6eb763d52615f6c76a8aa0230d43012744c4370513e5be2b07b50296d0f22c0a2422
-
Filesize
2.8MB
MD57495823ba52181d27f45f06d201af7a5
SHA15289daca409d49f3b2978fd74797f595eef34021
SHA256ed5ab4f6f745d018831406077343ce16f52a15f171e69d6c33392e207b10620c
SHA512f8c06ffda50f7c4b3dda241818808cad082f4ec77b985dad483a78d56630bd1dcdee45412a4069bac3d2434707bcb243e9998c2fb558c46af226310a9a8cbc33
-
Filesize
550B
MD52857e33c32289395d1882c5626f23c92
SHA10437eae6e243c844f2219df6a491f10bbf7e677f
SHA256fde36dcdb878f5de2a8d11e53359cb42db0a84e5ca16a5a4f5e4f1b88de43ffb
SHA51267f1ab0936b15abeb94966a463b0af3ef6e58e1a186d64479cd724f1259f6644e064e9e317fe14a5f0a552efa7ee4fba941e7e34031a0428797122976a0cfc5a
-
Filesize
597B
MD533b3a8ea4ccd4dc380f9863245e1eee7
SHA147eb1b4594bb3a30b20cc648288f2ab1ae7b3c1d
SHA256d21a7fde1e3d92e324abb739f550fc004a7a320405fe302fb23bc94ef2c53d16
SHA51210ea0ef3f5e3322f673578137f901e217c14ea39e7ea644a2ec28344f095fd71667303cf0ec0ca60f96e881d033ba76be57ff10d769ff3c460b963ed78ba9a52
-
Filesize
2.8MB
MD5052f1acfae80a88950f31597f4a9bef3
SHA1a2fe90ec0b675b87c45d7d1976946c7384002861
SHA256b0ffe7f488447cec35909b8f70756f8fd2c69b012e1251e9ce848a280c8b84e1
SHA512042364ff97da1950b80d4b395b826c945cb7e5299be1764059411547a193d989a1aae66edbe10d339a8a7821ab8f50c61d560257b2ce5194dceaf12559ac6158