Overview

overview

10

Static

static

6

398f578739...ad.apk

android-9-x86

10

398f578739...ad.apk

android-10-x64

10

398f578739...ad.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    12-09-2024 22:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    398f578739425fbbe54c471bd502576ddf2084b20a28f3e6166f8145036530ad.apk

  • Size

    2.1MB

  • MD5

    3f3499096a970b94f7de79fef439b203

  • SHA1

    15b62d1c3e2841fb93dae4d9313738c99dfc37e7

  • SHA256

    398f578739425fbbe54c471bd502576ddf2084b20a28f3e6166f8145036530ad

  • SHA512

    f12d2fd9490dcbbea45d6733358487efa2ad2b71a719aa69f6d7557336e6135d4d8d3b5122c79c867a150e33e2c2a39d3f756c2b4fea0a6528e71f5987c12473

  • SSDEEP

    49152:hNtvHIp2Ty+L0sdY8A4/4TZvab6X3D3VSWXVTJLuMSEjQ:BHYoL0sdrA4fbY/cEjQ

Score
10/10
hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

hydra

C2

http://silversilvershine.com

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery

Processes

  • com.appear.exact
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Reads the contacts stored on the device.
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    PID:4496

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.appear.exact/app_DynamicOptDex/JNdxX.json
    Filesize

    971KB

    MD5

    598a47129453d88a224eb2b038db2047

    SHA1

    5b5fc1e79ad8c65d1ed2e413bd0b2c5d3ee098ff

    SHA256

    954ae883c90e59e31280b15abdffbf977475611f1950bd067221209cca8ca09e

    SHA512

    2679c4ae8e6245c5dbf0ed0bff03c04cb5732ef12cf47197e01a5a2b7fd5691069377bbe2333bf2ead1e74685a8411ff3ad17476a54c0f3286f4582b1b22dee4

    Download Submit

  • /data/user/0/com.appear.exact/app_DynamicOptDex/JNdxX.json
    Filesize

    971KB

    MD5

    58fcf31e73d4ec1600420517c45a2e45

    SHA1

    90a11c911d2e6411c69735957aa398b74b105f68

    SHA256

    6808ace8173d2899a6e3d3121f7df45cd317f28ed520aa853c9119bf26e4df02

    SHA512

    6150c17c57d7ebbf7056ce29c090f007fa92dfa00ac5413a5c1a32276cd037eac1a61a80839efe76d65e2afe166dc4ff180d8d320e697d4799c6966ab7a2c3ae

    Download Submit

  • /data/user/0/com.appear.exact/app_DynamicOptDex/JNdxX.json
    Filesize

    2.2MB

    MD5

    84a4de730819f82e39f45a59cba083a7

    SHA1

    da83817f06bdaeb12c8db4b3f22ca741d3c118c3

    SHA256

    09e163c2bad9dc7e7b1d54f6881c78ebe5794a01d772707c9a3ab8232eb8254f

    SHA512

    8f9ba46ce16dfa4b16bb6abf91fe3ad142af0e6be81a14db8d02d2f5d40913a54accb24a36612276b407921357bd5cb4e8dda5e58a532537c863d819b52263bd

    Download Submit

  • /data/user/0/com.appear.exact/app_DynamicOptDex/oat/JNdxX.json.cur.prof
    Filesize

    1KB

    MD5

    3ebc8a1116d2a32e82d7547fc8dede10

    SHA1

    67cfaec2b440048d61d31feb214f9e7a7b2eec6d

    SHA256

    74b59a9bf69365cb40a8b01a2edaa431cb275d7ba43a6f7646ce9cae75d1c4a8

    SHA512

    9f27e32d7e12ddbd1407516a0ace2146adc8bc6b51cb69c489989c1fe5f4c8cc6d396f9e75b310048fa9533059845170ab425795a6f58cf948025a4d37bfabf5

    Download Submit