Analysis
-
max time kernel
179s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
16-08-2024 22:09
General
-
Target
f2a59687a2ddfab336d1bbea27de31134a412d3730e06220e51fbe16ede9964c.apk
-
Size
4.9MB
-
MD5
8c2a8923ea3d531a9b8d786256b1aaa8
-
SHA1
cc8e07ac78ddf1ae756378cf0cf62daf3eb1d4d3
-
SHA256
f2a59687a2ddfab336d1bbea27de31134a412d3730e06220e51fbe16ede9964c
-
SHA512
900fd0475053a3eb64814294d7bcfc090ce016ce84393183e831770491cac29781d5a7f02a3bca04031c798576ba187991b60910310db6d484e9e0c3aa7a1928
-
SSDEEP
98304:cKe8xQ2rBZGGKa8PpuYuqYFcnVBahRyheguPoVaHI/dwjpvfhQMly:cKeSNMxuHSH+U0g0YO9feMly
Malware Config
Extracted
hydra
http://wefjiwejfwjefjwefwjifwjfjwfjwjifji4432.cfd
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes
-
com.dcqjifsib.pipoeqmxr1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD58f308dca289255f804d884e65fb9f2a2
SHA1240b935c3299e529cff072f4255f0c0736a34aa1
SHA2569500021946a004b7bde4f5ef8e9d78fd8c5d135b779a194bd976e3cbd0208d96
SHA512629e71eeda9976d7b306b11a79618e1ee42eeb47b901972d30227b2b9f9f0f9c7bd94897624314b2299767dd4e5384d20e987967dfc29444f6288462ac060d91