Analysis
-
max time kernel
148s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
03-09-2024 22:01
General
-
Target
7823e4a4bf3223cac35ba1f2a83ab618432033d37c6bcc9deaad82231f1dcc18.apk
-
Size
2.7MB
-
MD5
1db576879cedc1ea1423919901b20f03
-
SHA1
d63474a2d8f4e179c2b96410d41ac8075ce99e9b
-
SHA256
7823e4a4bf3223cac35ba1f2a83ab618432033d37c6bcc9deaad82231f1dcc18
-
SHA512
b0b1b7e3cffc54ec12de812797a1e6af4c41e41588e98c35336d92a7fb3f339745af6c1cda062966a2fa51695195beaffcbdc14bbb0db4d665dc9932a69bc235
-
SSDEEP
49152:Lee8wd3LnlICoXiLMjCRFctD4AaVYvR9wvJTE1CoYpAQ/BiZN72aGM9OP6:LRH35QjCMtMAaCJyvJo72oZNo+Oi
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.have.must1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5cfffce9cd9aeb13f21ddfb4a99c6973a
SHA147e32d739ec2808d464ec018d0fd786bae417682
SHA2567d3127513b321084b1c2d43b2354b76bcb64b8449d6996779e1436dbda3e6d13
SHA51249bf2ded4d46ef6ed702738bc79a0a4e17ecdb7aec1994a28f6eca2431644beb765e9318c95b98a17cb946f1b2ee3c5277cad274a56b264fbea79058cd465c5c
-
Filesize
1.9MB
MD56560a482af642941de14e5a6c5d9ec69
SHA1579b826c970bb99e3f616222792da1cc1ea3b9eb
SHA256c26e2560f93698501c556ae69b597bd7accb04fdcf97f4f908e6ee43518545eb
SHA5123a44a2f268c99c67dd53982dd21fa534f72bf2635da9ba7b12758549477117abbccf2a7ff047da70b6360317f7b24ad855eb83d162a366caec32ce3d68ea1fc3
-
Filesize
5.0MB
MD5937e02a93fa37a55a03bda88b45dffed
SHA155e4386927ca274b6b571712072bdf107d95f8bc
SHA256b0913a37113b1453c649c650adf12c7f1a29957a5064d28af9bf781e13e889de
SHA5125b5ba5481f7e2a3f1b776460a631d63ccce35b45827249f3957c2e1bd01cfdc54e8e31863939e94484fb9d0ed01353bd5f144ca6f8682ab3b4c5cfeb8905d8cb