Analysis
-
max time kernel
149s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
12-10-2024 22:02
Behavioral task
behavioral1
Sample
364bfce93060133915405a4fbec989829d728f3374b36003b36f10370b33763c.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
364bfce93060133915405a4fbec989829d728f3374b36003b36f10370b33763c.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
364bfce93060133915405a4fbec989829d728f3374b36003b36f10370b33763c.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
364bfce93060133915405a4fbec989829d728f3374b36003b36f10370b33763c.apk
-
Size
1.4MB
-
MD5
910eddbeb3ca2377938913c6188bc32a
-
SHA1
b9f2fb2e84eaa5a858a32548d3b706cb76ad0a2b
-
SHA256
364bfce93060133915405a4fbec989829d728f3374b36003b36f10370b33763c
-
SHA512
fd4d2f7d41d5294b36fdc27934f332b8d901f345dd7309e1c1ad5f5f2324ba349ea763abb26ebb4bb1c386d9ce5f7ec9ff8c1ebf14515d73a957155f0f908c79
-
SSDEEP
24576:4gVnuJj6bR/4ZGnEIjGUAINVwaawc3Dj4v6pyM3UO0cVQcxu:4gVnO8RwZmE2GmNyqyj3B1sUu
Malware Config
Extracted
hydra
http://taniyemezdoledked21.com
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.grand.snail Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.grand.snail -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/contacts com.grand.snail -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.grand.snail -
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.grand.snail -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.grand.snail -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.grand.snail -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.grand.snail
Processes
-
com.grand.snail1⤵
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4259
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f
-
Filesize
17.8MB
MD503ad8690954c496bee1f13e2ed1d1b74
SHA154665184a1d633f8c4faec5b6a7a06ab576469da
SHA256382c0ec6f7d5b48bd8490498e0fdc32e1784b9a037464a9162895bbec93b490a
SHA512e87992d7643b9395d01e522a4be5fb4ab99ebd85ac44da269c1471ce3ae2db08b60c7dd8796bff254005a5b4b07445721191cf1210cb09fcc6f17fe2e8c84b73