Overview

overview

10

Static

static

6

93d5a3d311...18.apk

android-9-x86

10

93d5a3d311...18.apk

android-10-x64

10

93d5a3d311...18.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    93d5a3d3115b514fedf7eac4b3e7f798_JaffaCakes118

  • Size

    2.4MB

  • Sample

    240813-ts6wraydlm

  • MD5

    93d5a3d3115b514fedf7eac4b3e7f798

  • SHA1

    2089c90240fda961676bb9b6425d11ec2818bf44

  • SHA256

    784d7899e33b6cb229556dd19d2aa8090df59c8441e520c6c1d5f648ace2a55f

  • SHA512

    3c49a97eac70025be87f64e4f702ba4622173289fdefe2416697cea880205b847697b66665e412e6b83650cf7e1510697f215de4607624e534d377bc89b50211

  • SSDEEP

    49152:19/7TbwQYwkXYIOlcKK6wYYjTDHJopPzQ+p8kO:Dbx0XucbxTD6pPfw

Score
10/10
hydraandroidbankercollectioncredential_accessdiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Targets

    • Target

      93d5a3d3115b514fedf7eac4b3e7f798_JaffaCakes118

    • Size

      2.4MB

    • MD5

      93d5a3d3115b514fedf7eac4b3e7f798

    • SHA1

      2089c90240fda961676bb9b6425d11ec2818bf44

    • SHA256

      784d7899e33b6cb229556dd19d2aa8090df59c8441e520c6c1d5f648ace2a55f

    • SHA512

      3c49a97eac70025be87f64e4f702ba4622173289fdefe2416697cea880205b847697b66665e412e6b83650cf7e1510697f215de4607624e534d377bc89b50211

    • SSDEEP

      49152:19/7TbwQYwkXYIOlcKK6wYYjTDHJopPzQ+p8kO:Dbx0XucbxTD6pPfw

    Score
    10/10
    hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencestealthtrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Reads information about phone network operator.

      discovery

    • Requests enabling of the accessibility settings.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Tasks