General

  • Target

    34d77868cbf62fda6b88a5c7b037d3f3.apk

  • Size

    4.4MB

  • Sample

    240805-hdw78ashlg

  • MD5

    34d77868cbf62fda6b88a5c7b037d3f3

  • SHA1

    00cdfeaa48544e5c6f0ba3d9329bb015e51e5972

  • SHA256

    4e20b8bf1a926e7d5b84e75c920457d9dc572ec78b9a23d1b08afcefe9b78e5c

  • SHA512

    c4e6e76c670d94062cedac1abfa814e2062087cc12626581c66754b642c17f5d296a5e37b546a9549f30a9a96e59daea8e2b7f86786f999b75124791f4bbcd8b

  • SSDEEP

    98304:LCVeYx5HKqvpDRG1DMlRiQQxX/sqS1zHOrBNI:LqXHNvwp5sjzau

Malware Config

Targets

    • Target

      34d77868cbf62fda6b88a5c7b037d3f3.apk

    • Size

      4.4MB

    • MD5

      34d77868cbf62fda6b88a5c7b037d3f3

    • SHA1

      00cdfeaa48544e5c6f0ba3d9329bb015e51e5972

    • SHA256

      4e20b8bf1a926e7d5b84e75c920457d9dc572ec78b9a23d1b08afcefe9b78e5c

    • SHA512

      c4e6e76c670d94062cedac1abfa814e2062087cc12626581c66754b642c17f5d296a5e37b546a9549f30a9a96e59daea8e2b7f86786f999b75124791f4bbcd8b

    • SSDEEP

      98304:LCVeYx5HKqvpDRG1DMlRiQQxX/sqS1zHOrBNI:LqXHNvwp5sjzau

    • Hydra

      Android banker and info stealer.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks