Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
12/09/2024, 22:08
General
-
Target
398f578739425fbbe54c471bd502576ddf2084b20a28f3e6166f8145036530ad.apk
-
Size
2.1MB
-
MD5
3f3499096a970b94f7de79fef439b203
-
SHA1
15b62d1c3e2841fb93dae4d9313738c99dfc37e7
-
SHA256
398f578739425fbbe54c471bd502576ddf2084b20a28f3e6166f8145036530ad
-
SHA512
f12d2fd9490dcbbea45d6733358487efa2ad2b71a719aa69f6d7557336e6135d4d8d3b5122c79c867a150e33e2c2a39d3f756c2b4fea0a6528e71f5987c12473
-
SSDEEP
49152:hNtvHIp2Ty+L0sdY8A4/4TZvab6X3D3VSWXVTJLuMSEjQ:BHYoL0sdrA4fbY/cEjQ
Malware Config
Extracted
hydra
http://silversilvershine.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.appear.exact1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
971KB
MD5598a47129453d88a224eb2b038db2047
SHA15b5fc1e79ad8c65d1ed2e413bd0b2c5d3ee098ff
SHA256954ae883c90e59e31280b15abdffbf977475611f1950bd067221209cca8ca09e
SHA5122679c4ae8e6245c5dbf0ed0bff03c04cb5732ef12cf47197e01a5a2b7fd5691069377bbe2333bf2ead1e74685a8411ff3ad17476a54c0f3286f4582b1b22dee4
-
Filesize
971KB
MD558fcf31e73d4ec1600420517c45a2e45
SHA190a11c911d2e6411c69735957aa398b74b105f68
SHA2566808ace8173d2899a6e3d3121f7df45cd317f28ed520aa853c9119bf26e4df02
SHA5126150c17c57d7ebbf7056ce29c090f007fa92dfa00ac5413a5c1a32276cd037eac1a61a80839efe76d65e2afe166dc4ff180d8d320e697d4799c6966ab7a2c3ae
-
Filesize
1KB
MD55e179a30d124c812c38a56684788aa44
SHA13f60c535df4775b1edfef858e81a02cb0f106d6b
SHA25616b720b2c93fb532c328c82fc8691a5882c73ea1ba752d3cf5e89a3c473d4944
SHA51208b26d3ab701dac57ebf4fa6a22c8810547f883dc6b9d49b568f71afff1839c95e69e10613dbcfb12b6836f70a76c3d82747a275acef1fea83dc90ac119ff705
-
Filesize
2.2MB
MD584a4de730819f82e39f45a59cba083a7
SHA1da83817f06bdaeb12c8db4b3f22ca741d3c118c3
SHA25609e163c2bad9dc7e7b1d54f6881c78ebe5794a01d772707c9a3ab8232eb8254f
SHA5128f9ba46ce16dfa4b16bb6abf91fe3ad142af0e6be81a14db8d02d2f5d40913a54accb24a36612276b407921357bd5cb4e8dda5e58a532537c863d819b52263bd