Analysis
-
max time kernel
179s -
max time network
137s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
30-07-2024 22:02
General
-
Target
d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7.apk
-
Size
4.3MB
-
MD5
4139c26388e4dc5ca08b36d103b225ea
-
SHA1
f656e5c271fe5fed3b23d28a52a9790b2fcbd3ba
-
SHA256
d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7
-
SHA512
e35d2389383d027f9b3b71e5f11b3b3b245c6ce39d7b2aade9d424f3903324fd51c9bc692a5309ae2528b70c562bc366c49717b21bff2bf45fc73916f91acb09
-
SSDEEP
98304:P10YaLxIEJ+gfScHk/xVnqBtO8ydyuFQ5AVJAz2B:PCYa1IOqcEDnktOJM5+JN
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
peace.close.visit1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD574ff72f8e4bcb5900c2a77b23de3ac08
SHA11831e0eb53a220944e34887750e80ef15f712fbd
SHA256a4264e05a0e7d5706f172e4e147ba67554746afe777ccbba42f704c568ee57e4
SHA5121df2abd8bf4592973c1ec684f1abf346fb58fdf5fb1cb74034bf8917474c6eb763d52615f6c76a8aa0230d43012744c4370513e5be2b07b50296d0f22c0a2422
-
Filesize
2.8MB
MD57495823ba52181d27f45f06d201af7a5
SHA15289daca409d49f3b2978fd74797f595eef34021
SHA256ed5ab4f6f745d018831406077343ce16f52a15f171e69d6c33392e207b10620c
SHA512f8c06ffda50f7c4b3dda241818808cad082f4ec77b985dad483a78d56630bd1dcdee45412a4069bac3d2434707bcb243e9998c2fb558c46af226310a9a8cbc33
-
Filesize
1KB
MD53a2bf16ab01f351598dd1d2aafed1e75
SHA1b02aea3e066d1c7a441bfb30b4120549f003c406
SHA256d7e7eb747379b7d1eb6f4aa156584b4bbd9bddc9a379e907e1ffa271e2fffd9c
SHA512e9f6fdf4b2462b35bcdda5f1954bf683b6f03cc73cb291c30916c8ba956ec76f769041214840182aaba63a3404685b7d8e944e046fd85db9113e67b86522b7fe