Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
19-10-2024 22:15
General
-
Target
3cbb781b869982c73980cea6e96aa18f9d1f4aaee96ced38291c2481adb44ccd.apk
-
Size
5.0MB
-
MD5
b5f231d6028f434a98ca31b81d4ee6b5
-
SHA1
b23cf7c3c7a04973a428f8ec6a052fc62143888b
-
SHA256
3cbb781b869982c73980cea6e96aa18f9d1f4aaee96ced38291c2481adb44ccd
-
SHA512
668aa7274ba674e612317f69dae427df881d4c9c140996e8d7f89e7c3efb66ccd133748f9b4558c15a1c0ebe093fde91d107e013baa2a405f6d0f4af03339dae
-
SSDEEP
98304:k/Ix+SSeBexGm/KaOTgWRluKG+pkG0kjW+GTrWeNS:hx+SCxGmiVluKxbW+GGMS
Malware Config
Extracted
hydra
http://darisamu.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.dktizxcuq.gqvxiovlz1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5b842340384fdaba5fc4fa449a067ae74
SHA12e907af7ce9a9d5a53e94d4896986a6f67c6547e
SHA256c248c6c6d448acf41f5add78f60331f2da35d99da16a91e7823e987ac96ae021
SHA51206240971af8c1278afbe34422fc0a9661e8cdc8702de085852b5334d0fb0ee06f73c3e13d629ca710c4a9b1ba294904a0cc0b247647254c18e879fb83c4040b2
-
Filesize
1.3MB
MD54a1f765647cb43bcef0142791ae65e13
SHA1b271d78bb961b80851feec8a5859fa006e825cff
SHA256f68ff420181d0d21da343020d1de80dff5c286774350b9eba4f657acd0129da0
SHA5126bfe262e2a4e629f815cfba67fbac0344b553f5d9530def46f46153e4e296e79cef11a6084549b3575de1da38cd33ba09e65eca7b5c616eeb66df01da6080966
-
Filesize
1.3MB
MD599abf5f2e169ff57c596463df750e084
SHA1c60e39f9c1cd16dbd678c0c95f6a12e3e01f2fc4
SHA256314263c5eaba7a258673867e37b279d13edbf5bda17a5d69c144d8ccd2f8f9cf
SHA512deeec669f7547abf123fdd3d5b57a2d0bf810abd761ac0d9ce1c6538dc546dec3f69cdf7c23c66e28910c2e5550faad3e866efd19ac224c725a49ac6a4aa8483