Analysis
-
max time kernel
149s -
max time network
150s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
08-10-2024 22:03
General
-
Target
1b6b8e05971735f00a7d1e0b1092c300692b76e07f3fd6a3f202e1a2700c48f3.apk
-
Size
3.7MB
-
MD5
9304438e075b0cc45e10fd754a3bfea3
-
SHA1
08db0b52930d63bac86c7ee75c73c00ba9b401a9
-
SHA256
1b6b8e05971735f00a7d1e0b1092c300692b76e07f3fd6a3f202e1a2700c48f3
-
SHA512
b3805c54e57d385705b47d870804c6b3752945015bcfdb8ea38ac3ab5eb5fb4c85b4b03d9e6bf35023ef06b0221097b2a365b0e4a69462a05c299d84bc3d8c79
-
SSDEEP
98304:DkirMldgvHtOS+meGxOWTUvvDAIP3bgQhrZ0wU11sXs+PM7sbhJk:D5r4COsxOW+P/Z0wU11sXsOMQb/k
Malware Config
Extracted
hydra
http://yahyolkayhodses.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.potpkaccn.hvrkddbgh1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5b70aa9b8873b5a45b66c3a2b3b7f5c7a
SHA195dd931540ccd1ebbfeb59f223d47266003c448c
SHA256753f626893893ec7f7f1acc062a7d506e95e0c024a4e0ff3b5a4883fbb2ff6c3
SHA5129eb5e2fd0283fb98c6288823491b66e651acd467de4e8f8685f889e2efd8c8bcf1186cb6ad3d139a336383d4fbcf626adbe2863da2191d40cb23248209e73d7c
-
Filesize
1.3MB
MD5d4ff108e8a7c32a70ab8dd16e238693e
SHA1fbc36d8fa47488ef4996dcfcb56398673c53220c
SHA256d0501687ebad3182c5654ba36f907d351ec008e624d1478d7860aaa2e43afb2d
SHA512d8c4ef64b02f3e81a44d6415d6c0dab73033281292ecba7bf12ba353c8a809bac529f45d6baf714f4c4a4cc58f6c0cb4c10301d179d464541032439ef232b1f7
-
Filesize
1.3MB
MD54637880dec645be61f438107c2789261
SHA17e22dbff36f658bd4aaf44fffdbc6475aef61f1d
SHA256aa520c835d37a9397e0d33d60c355b3005759e5a1351acb1c68f7cad761e871d
SHA512f079922fb66e2e3f7a5ad15029707618333601cbd14e8a57c61a7ce08e04188cdd03c235faa7eec592869d6ad87212b251eaa6ac38fa07e6234cb85107ce43ea