Analysis
-
max time kernel
179s -
max time network
174s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
01-08-2024 12:55
General
-
Target
ddf446f2164bcf6bd46af668dd245fafb3c32d7b5620bfa7577978a8ace2acc3.apk
-
Size
1.2MB
-
MD5
8660acf5909d0af99d843b2e268d16ae
-
SHA1
6f7649255b1cb7950e19e8ce78dcdf33b62020d7
-
SHA256
ddf446f2164bcf6bd46af668dd245fafb3c32d7b5620bfa7577978a8ace2acc3
-
SHA512
e6531e8290676614f0f46730f7bab1c3414efafef656d37d4142549b316e0df5718a8eb4211feb29f3d7b853b7968983618640fd3569dabb4c2266e85da2ff39
-
SSDEEP
24576:8FjqE4sijToAeMf2w9jrf28k434tyqtG5pbheOoeEj6+DhssEja:s4scTX9jrf2wqoj4N6s1Eja
Malware Config
Extracted
hydra
http://mersintantuniad33.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.grand.snail1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5ccfaf0cba913b26cc3f6994cddd05549
SHA1a4b302c886d8284187dd81123efd8039a072d119
SHA256eed2e1a100238dbfdd57a185e36ebe34d88cf6ee739e2f740d6a5d0291ed0814
SHA512a0d130fcb9d8558aef98171e08056914bfee6e217d91a3fc400f0cf95bf9a6c655c2698ae8323eaaee48fa29112eee2ee4d1b3456870d282e0e2ad21b094ef18
-
Filesize
1KB
MD5e830e0d66b2e8580c474c93e7b6470fa
SHA1a609cf3b4b93e2c2d109698f1daf3df9ec22455e
SHA256200b90ab88a33d1c8a49f298ac8e83824f738fab82e546af2fbb81b5f00bd553
SHA512a768163b694cf3b6c2733ef076a374b9eec1218cd7f7b3da28e9a9e2e1a8b3f526d84b4faf057714ce05abd7b77a7b3fd2bca59194f49dbcc7324386dbf9e665