Analysis
-
max time kernel
149s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
06-10-2024 22:06
General
-
Target
87226492a1c4f5126d3aa27b7dae24fcd9bc57817a69cb5d817f617bac6ed7e8.apk
-
Size
1.4MB
-
MD5
8a9cb772f5b7ddfac139da6372bcdbe9
-
SHA1
ff9e55b1e648ab9946325de112420ed098ea5b4d
-
SHA256
87226492a1c4f5126d3aa27b7dae24fcd9bc57817a69cb5d817f617bac6ed7e8
-
SHA512
4b33920e6f154dde132566f2dc7a246a09b87b8a89147e4aac7ee78dc103ed10f81c7d967b612c77c454a07e719188ed6eee1b76f6f37aabbf3d66a271ad52a4
-
SSDEEP
24576:0gVnAEJ6PR94Z4/JecuIi8nhBCCI3vYOh2lv4TdFGHAor:0gVnxARGZTcRi8n/6wO7Tb0
Malware Config
Extracted
hydra
http://vadafoneszos.com
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.grand.snail1⤵
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f
-
Filesize
72.2MB
MD5e3c6287a09ea6f70d2622069287982cc
SHA166eb1db5f1480f0a8f648bb73e351314764e43c6
SHA256d479dfe79ccccb1baa3cb45a658c3881320d88f08e3cfb17acd99f0362e22b4f
SHA51211438ae07e8f8632aa16282442caaa4b0cc7f092a63a3c698fc80671dd0632bd93f65724cf0d51de3d0771807732e03c45ac95a88202efd2a1c3e811e0d51fb9