Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
05-10-2024 22:04
General
-
Target
e4144fd04fd0626b98afcca0cebed4318547423c488340d616cfbef341fd24ea.apk
-
Size
3.7MB
-
MD5
75865322f14eafda0c071f5e0d52a960
-
SHA1
db07a478ed13b76af5eae309c9800a6a4223f345
-
SHA256
e4144fd04fd0626b98afcca0cebed4318547423c488340d616cfbef341fd24ea
-
SHA512
93cdf059a55ce75de89634df1f53af302ab7ff6904d17a5546459a495d68775dcd7390bdcedf5d6380a537e8b6a3fdecc09548d43852a2b5ff346a5a46ce43a1
-
SSDEEP
98304:1EPBpse2JijPOeIEQSyKpJAuyYga59o9uPpP:OJ+kOHSyZu9gazo9MpP
Malware Config
Extracted
hydra
http://cangerconger.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.ypgkmdprf.hiyfwgjyc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f
-
Filesize
2.7MB
MD5e8fe70635577409ef8d03bb9aeec69d6
SHA1c8d8b08dbff618f7f99f0b3f1d57ef8161a77cb9
SHA25653bef8a689c97a2f784946f9c139c50748e02e6433c4ced8bc8e2b75706ba11d
SHA5128643ca8cda1331ac6f490c0a85a77b91fba02bc7f31ab6550c2da9ca6b4df9c83a2f98ab5aff47a941d7cea701d8bbb838a8a4efdf09e98a7f041811f76f6d5d
-
Filesize
62.7MB
MD55132333fa0520e8416d59a83d71ab1f1
SHA12bb1d1247aebc894ecd37649bc8eb63cd42f2ccf
SHA2566e2f8d48a1b91137674de62f4b84371017f8d3c8bcd3821ee146c3a99842c5a6
SHA512582458f4bcb839284483cde0aa6576fb778186a0f57003d055c2247147f6aaf533ecd5acf726002abfe416a07c781b379ae5e3556d99f89d835c26d0cbfb7381
-
Filesize
1.3MB
MD5db0f7102d18b8678a37b568966e989e3
SHA11fb44a506b8f2975896f56ac22c045d18b9e1dad
SHA256fc4d78bd7d0b1358ea0f837b7386f74cbd24e4723db254a3fe217a181e34d460
SHA512646eaf05b479f540ab50158d79fef859097bd1e2189c06503cea144a541f1f1bdc14f500c8c9b4c8a7657247d806f9ab05c869b8a627b05a804d07d00defb7ed
-
Filesize
1.3MB
MD5648d8f4e1e21abe7dbe8280c12efcb0f
SHA1e9880db45c184546a1eef942f5d8bede61c2d8fd
SHA25677282ee6391612251e3e4704558b239b6718c8c9cf2afb001498c287d0be09f6
SHA51212fa917c11c8009b2592516cc238f524178ac41dcd374c7163d6c3016076d04aef90acf88e0477e183d54fd0e92bb69930db5fb6fe3800ed333b4cfaca2a33ba