Analysis
-
max time kernel
147s -
max time network
162s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
05-10-2024 22:04
General
-
Target
37616211278f91dcdd1eff37f0676b1b8f0e3ae0e916be09283ce04548879951.apk
-
Size
3.7MB
-
MD5
6167f6870bcd7544b54802ad64613730
-
SHA1
ed8f07fa36dfeda7b271693fa3c8ef7b3a34641c
-
SHA256
37616211278f91dcdd1eff37f0676b1b8f0e3ae0e916be09283ce04548879951
-
SHA512
5364258978d4ab271bf6e1a1a1e24ebba84f25bfb7bed3b179f2a384011776cdf5e878c56886c89cf25295bf4c84f51e0d433f1b29b68772c18e0d6a8af8b08d
-
SSDEEP
98304:OJv+JOGJ5TjbsokQMNOSE3+D4yIn0oFxHxcPiPBr:OJGOGJ5TjbvfcEX0aHBr
Malware Config
Extracted
hydra
http://cangerconger.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.bzmeccmlr.ijkljwevo1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f
-
Filesize
2.7MB
MD5f66e1b51ba075b67fc91fef97332d2e4
SHA16cdd7fb13563ba87e31a998fb292fdf107ea753b
SHA256e7f6567f59dafe35595fa6f0ec99eb7102a36b5f4c761e06a4d56cea802e4424
SHA512ae624d86a0e0d1ae80c19964b84074707aca730775c80d6f06e62e1bd3cb12210a94d5fb197e8461ce68d94a35409fe0ebb0774feeafdab0581d57bf7d235a31
-
Filesize
67.8MB
MD516dfa83046f2bd93f658e8841a8db0be
SHA12c26e075bea87f8a622562d9bd6f391de69d1847
SHA25626c9b8dc2b3c0daf3ba973dd80256e1f7289791561cb73192a7e7340810cad2c
SHA5125e8bb0caf40a060a053865e8600313851083ab7ec8f5100626f22e828fc067a51c40db17c2038736f9e88011c892fc6424f5cb7f4328c3fc07b67b8288e5ffd7
-
Filesize
1.3MB
MD539f81169125a260aa65b4b6ce95b88ca
SHA1ecd67f5524bc16b70686c9e8e0b735e8d74bcc37
SHA2564663eb1d510787c2e978e9e7faa316d34d79cccb0698336b0436b9d4109f4f4b
SHA51277f2a3624cd732bfa935740591e96dc51120056876ada99d12328aafcdcbebd29379a3193d7ce6898ccefbf558f1b5f7772290bb8b78e236390bda5389de632c
-
Filesize
1.3MB
MD53d24a62a7436272ae6fdc5d28d051377
SHA1f8eecd5d893e5fdc8130c16da3310900812eeafb
SHA256ce39f0c6b364d3dcb49c790d073902543a51da8f810dddab5bb21d9fe04f2a93
SHA512891921d469ab03bf81e93851caf6215938cfc93e81b574afed944883633aaa421210819004db4b22627c9b257d8975e61f1981a44b07d95d93065062c567fb52