General

  • Target

    77fa2d3c724cc9d28c60898ec66b0e5701a3618d5882f3d8fefbc5cba354e8d5.bin

  • Size

    1.4MB

  • Sample

    241008-1yxzcswajf

  • MD5

    75d9f918c6f28f7aa3cf39b674bc7baa

  • SHA1

    c381822f003fd4d33f41d35fe4a8741f3eff81a4

  • SHA256

    77fa2d3c724cc9d28c60898ec66b0e5701a3618d5882f3d8fefbc5cba354e8d5

  • SHA512

    e719fd25993a9ed80c624a71f2cb414325d0bb2c4f5bed0fbe93ea340134fb9766dc83a3deca052d54dd426d71264496b43d7cfccba90dd7095cd5033db0ab1c

  • SSDEEP

    24576:XgVnxpW6bRJ4ZsEqLH+ow0bCjNh4yq25CrFLCjb/sd1xLJdw/Y7EJOk+VYrAIqAv:XgVnq8RKZsEJow0bCjc1Cj7MxLJdJrkN

Malware Config

Extracted

Family

hydra

C2

http://tahtikcomezcon.com

Targets

    • Target

      77fa2d3c724cc9d28c60898ec66b0e5701a3618d5882f3d8fefbc5cba354e8d5.bin

    • Size

      1.4MB

    • MD5

      75d9f918c6f28f7aa3cf39b674bc7baa

    • SHA1

      c381822f003fd4d33f41d35fe4a8741f3eff81a4

    • SHA256

      77fa2d3c724cc9d28c60898ec66b0e5701a3618d5882f3d8fefbc5cba354e8d5

    • SHA512

      e719fd25993a9ed80c624a71f2cb414325d0bb2c4f5bed0fbe93ea340134fb9766dc83a3deca052d54dd426d71264496b43d7cfccba90dd7095cd5033db0ab1c

    • SSDEEP

      24576:XgVnxpW6bRJ4ZsEqLH+ow0bCjNh4yq25CrFLCjb/sd1xLJdw/Y7EJOk+VYrAIqAv:XgVnq8RKZsEJow0bCjc1Cj7MxLJdJrkN

    • Hydra

      Android banker and info stealer.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Reads the contacts stored on the device.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks