Analysis
-
max time kernel
13s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
01-08-2024 22:04
General
-
Target
4d070efa5ba86967726d4118eed59e73bff79f0b5eb37e4b7f8d5a5a425cb0bf.apk
-
Size
2.9MB
-
MD5
fe356ab62b074339cc1e5636f44b0419
-
SHA1
6d8bd6810de1fbd7261328bdc85a4e1bd9c53f1d
-
SHA256
4d070efa5ba86967726d4118eed59e73bff79f0b5eb37e4b7f8d5a5a425cb0bf
-
SHA512
197bc4969f8cba22fe5a79268d191d59b108db1767218aff299fa5366285422cd3fef61b177347b92f0d291423e5b029835bb67eed0e48088ddff34cce6f6ecd
-
SSDEEP
49152:3Edb/J2TvxJVWKNqt4R+j25AH+T3ch7g9d+VRl1qHiBUdDYXwUoT+C3T8:3siv1WsqiAiUgrKiHim2XdoT/A
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
barely.design.rough1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/barely.design.rough/app_DynamicOptDex/mpFg.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/barely.design.rough/app_DynamicOptDex/oat/x86/mpFg.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5352bd89f0272600345d8590182feb5fd
SHA1891753992ce506c2750e87cd6cd8839e772ba390
SHA256db27332659918d9a90a189ae9ad1ca5417e27b03a4d044d604799fc8603b82fd
SHA512d1801c971cc5113ac325ffc58b2884e11d67bca90cf626a4856f3ec33022a591abadc5bf889f2479edbfbc655387877f023e3452fd8f590a2a601cbfbd36b5b7
-
Filesize
2.5MB
MD556513b4fdd59f5fe5657cbd8e7b955dd
SHA1e37ffbe24a090c90c593fb5971046fd210ce9d50
SHA256b97b4eb4e38db9021209718d72590ae4c9aeae6505a2486356f7cc537ac04c76
SHA512b67b81e2aca99ad70b001c28cd0bad9105404e0302a818f9b181343f3af698115a9498bcd89c5bf0ce7e9abffdb1f06999cbed409ec817adc29a2688423e4b7c
-
Filesize
2.5MB
MD574f6704b3cf99f49544aaebe96c99792
SHA1a15087dba6bae85a2ba174899c7554ff037806a3
SHA256cba40ac0ed4ccb90f687ab5d2777add58d5afa3b5efb520fa6b53a96d300c118
SHA512ebfb9f16b85414ba84dcb72e47b95036d431f07b7e0493f3b0fc1773d5922dc6bb4accd760d0ace820a3fa75670b4803b73a494d0bd758cd093cf2c7e8b1b36f