Analysis
-
max time kernel
138s -
max time network
147s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
15-10-2024 21:10
General
-
Target
a6d27ba039ac9cb0d5a6a3cffca2002feb9ecb8cfed54ce5c0a768064084d43d.apk
-
Size
6.2MB
-
MD5
e5445cda1bf1f82fc1fd4edb1317c41f
-
SHA1
8b3d7122a94bb1694e1d3e33cbbd056e4350598b
-
SHA256
a6d27ba039ac9cb0d5a6a3cffca2002feb9ecb8cfed54ce5c0a768064084d43d
-
SHA512
84dcd079ac022faf2707c2cdb48bc656320307e0d03d58748de78a7fa73bfe8c071a491bdc4401e7b8d31e60024cae43c947307ffdc64d7c54e4f185076fe0bc
-
SSDEEP
196608:m8+atol4aXiwsyOKu/EywCJ8Uvqjn1AzA3dU6Ecsk:m8+ayeNwsL3Nw7UvqjKQU69sk
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.ombththz.ufqsuqx1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ombththz.ufqsuqx/tyfkjfUjju/HjIgfhjyqutIhjf/base.apk.gjGyTF81.88g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.ombththz.ufqsuqx/tyfkjfUjju/HjIgfhjyqutIhjf/oat/x86/base.apk.gjGyTF81.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5a7e99e760bc8421e85d52ed5c34a9e18
SHA1604b27b7938c8318fbb5ed7822f87ef8499cb105
SHA256f1d0c0fbcb6f8eb89f7fbf2b2415d7afc3ff077826ffb1edb13a1bb77f2b02a3
SHA512e04b2e983a8733816981ae1c8d5d5fcf42444e68f89501e9e2ba7c8149e5ff9b2ea8d3ca78f18e5180d341629aa93701d63bc6192c401ca677f29efe3ed3db1b
-
Filesize
7.4MB
MD5373a2af61f26e9c20f38bd02410132d2
SHA1b857d53be38d578aa2c5833fcde1deafaa91bd8c
SHA256ba32cbc21b3543ecb36f36419aae6dd82b08c9fc1e2ba52ba74aacf034c73e80
SHA51235035bc9e4cd4c7ba8e93baaa134ff313ff4581609bd86ee8bc986d48169144bfce821656af1504245522caa1329d2c7f78972d4d881d0debe782b66597a2f1f
-
Filesize
7.4MB
MD551e100964dbe5ee426745201f1f8b705
SHA1936ce15dcb75bff6409e79dccfa5137691982159
SHA256e2e6b1095041c1cdb89ed390e884de77f4c8aa8f2d820ecf1ccdd1faba2da427
SHA51263c9e95a2e3923134177aa36e87deceb652d3ae5bd8bea1a4db57f5ecbba53fc9ded9f263e18e37bef57c6b47430adfd04aa7933fc523f29a6556121e0cd42e7