Analysis
-
max time kernel
147s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
19-10-2024 22:15
General
-
Target
3cbb781b869982c73980cea6e96aa18f9d1f4aaee96ced38291c2481adb44ccd.apk
-
Size
5.0MB
-
MD5
b5f231d6028f434a98ca31b81d4ee6b5
-
SHA1
b23cf7c3c7a04973a428f8ec6a052fc62143888b
-
SHA256
3cbb781b869982c73980cea6e96aa18f9d1f4aaee96ced38291c2481adb44ccd
-
SHA512
668aa7274ba674e612317f69dae427df881d4c9c140996e8d7f89e7c3efb66ccd133748f9b4558c15a1c0ebe093fde91d107e013baa2a405f6d0f4af03339dae
-
SSDEEP
98304:k/Ix+SSeBexGm/KaOTgWRluKG+pkG0kjW+GTrWeNS:hx+SCxGmiVluKxbW+GGMS
Malware Config
Extracted
hydra
http://darisamu.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.dktizxcuq.gqvxiovlz1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5b842340384fdaba5fc4fa449a067ae74
SHA12e907af7ce9a9d5a53e94d4896986a6f67c6547e
SHA256c248c6c6d448acf41f5add78f60331f2da35d99da16a91e7823e987ac96ae021
SHA51206240971af8c1278afbe34422fc0a9661e8cdc8702de085852b5334d0fb0ee06f73c3e13d629ca710c4a9b1ba294904a0cc0b247647254c18e879fb83c4040b2
-
Filesize
1.3MB
MD54a1f765647cb43bcef0142791ae65e13
SHA1b271d78bb961b80851feec8a5859fa006e825cff
SHA256f68ff420181d0d21da343020d1de80dff5c286774350b9eba4f657acd0129da0
SHA5126bfe262e2a4e629f815cfba67fbac0344b553f5d9530def46f46153e4e296e79cef11a6084549b3575de1da38cd33ba09e65eca7b5c616eeb66df01da6080966
-
Filesize
1.3MB
MD599abf5f2e169ff57c596463df750e084
SHA1c60e39f9c1cd16dbd678c0c95f6a12e3e01f2fc4
SHA256314263c5eaba7a258673867e37b279d13edbf5bda17a5d69c144d8ccd2f8f9cf
SHA512deeec669f7547abf123fdd3d5b57a2d0bf810abd761ac0d9ce1c6538dc546dec3f69cdf7c23c66e28910c2e5550faad3e866efd19ac224c725a49ac6a4aa8483