Analysis
-
max time kernel
149s -
max time network
160s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
16-10-2024 22:34
General
-
Target
3e3079982215bc7c5a1f6aefdeec17d3c8828a42f3d002905395f1652c05e0b0.apk
-
Size
4.9MB
-
MD5
7a623017a2fb223f66adde57da6ea03f
-
SHA1
6e59e5c33ff3a46d0cf637e062ed056ecdef4d8f
-
SHA256
3e3079982215bc7c5a1f6aefdeec17d3c8828a42f3d002905395f1652c05e0b0
-
SHA512
3604392c4cecd3d162e412c976463bbd5ca83e7c7f9d67602a5f1d355c152f4757f091f435dfaac4f22ad0c100c416e37ed62c87dc7e6ae8a12b384a0ec94b5b
-
SSDEEP
98304:s2NWlLQ2RxYqRLEYMyCltg1FvNG97NWMJbM8TBWGQhWUnGxUYlTZX:s2gRQEx5TkSk9hWMJbM8o3hWVxUaR
Malware Config
Extracted
hydra
http://tahradtoynetcomez.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.dydzangag.mrcfuampj1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5991dd58da6badc83315cd3d44e461ed5
SHA16ec1a0e97b011684defa01edd6a4c24854551236
SHA256324bd13e498505c93cd42fe2337edab719545d3b5af23dcb95da3551bca53a20
SHA5125378093f2a8cb9e3a7c604cd9af99057ac0ebe0d5af395a7ff0dfead37724d9cddecf43fab80838648c05081951a811254cd40a356f80bd34747d313e66cd5d2
-
Filesize
1.3MB
MD5abccc96f6a823fc5e81bff15fe6bf351
SHA141fa6aeef1d2bab95a46346222698456798a29cb
SHA256f8b14eee370ee2b80fc6bc3b594e2d073e8b327f1f38b129b2e70350bad41133
SHA51286b5591e533a241a21a1768aa36d83d8502445fb608a41f8ee6c81b7a1d9eed66080014e14aa49c9e2ddec85b4464b40772fa966f462762ef6b3037f8d8b4101
-
Filesize
1.3MB
MD5db9d62a19eee91a1f44a74e342571267
SHA12fa0636a12c56d665b2c84a248474281074177ad
SHA25605afbdf7f33eeadc646e75a0cc220d64e7af9d82e46de24ecfc6d88862b90d19
SHA5126ef41219fd3dbfcadbbe3eb725272b2017e32bd4737572d77fcab1765f972e4589fd3abec329638938fa5279601570d0d5f53bfe875f688c4cafd9e447d5c0b6