Analysis
-
max time kernel
148s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
15-10-2024 22:07
General
-
Target
a45099d395e853eb014419dd3ec55476c098cfb5873c83936e1e4a81141455bf.apk
-
Size
4.2MB
-
MD5
162d18015b17034fe1b4f25e8a0e5080
-
SHA1
87d1de42aaeb433ccce200ae65e2bc6559135365
-
SHA256
a45099d395e853eb014419dd3ec55476c098cfb5873c83936e1e4a81141455bf
-
SHA512
48d327cc8019878178c460f8ca147118bb41c297dbf8d47e982840f82d4613ba24d59a327a5cbc42d9ab31dfdbf4ea44133598b549f836f378db68992eaa608b
-
SSDEEP
98304:KByqZjqEBB5dWpGxjg1U/i1wdXBE5lZ0mOSlVvGQx9:2yqZjhBBbtg1Ei1wdX2jJgQf
Malware Config
Extracted
hydra
http://aksd24j3232d32kd2j.xyz
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.sihyovopf.mlzohibgc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD51345d33c3c96e15974e98d20b24a70c9
SHA181de4e1096403e00334da7227bef772b7ae86cf0
SHA256021151dcbee31db0589e7703d30830c43855c065814531f7504d991ccc65cdec
SHA51278e506df1df77e2ac931c3b03f47ba921594edab72fb0d7f940eaf84ee7985c53d2672428d2473fee8af3dd963303f5495985ecae981b1d28b602bc6abee3617
-
Filesize
1.3MB
MD54950a1a3af989c956c4e580b8cf43eb8
SHA1dce58a6dc10fe4e8e7c1d5df661654ad6a866a47
SHA25682f97405192510f32061190c3875c30b92f5ac5e0ef9ac76b3ad9b4577cbfa47
SHA512c5a186f133461dcb6dee55ac83d85b9ec81c1922d139a8d0ed17367bbe51eb9b597d9d8c7910dbd10c001d3752c01e33695ae853cf4dc332139c01e0a4e282db
-
Filesize
1.3MB
MD557548c24c3d8f604d4c61bdc67a2af27
SHA10247207ead6601560f97d00e5e13f98aa9c059c0
SHA25661c61159d145337065e7ab1ee4ec7cd7a0c2d3766761482b5ee8f5673cad41d4
SHA5125ba48e32b059477b0b289487cf5d427ac459d6a5af75883d78dbd23cdb36174f810e8112e4cdc83a9b4161d2db711b47d280b33975dc70dac187c491cc3608d7