Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
19-10-2024 22:15
General
-
Target
e5cdcf5aa31780284148b2816d4bf34e3dab333acf7fe147a5c76c470412c8cc.apk
-
Size
4.9MB
-
MD5
e072fe8f39af592bac537f9dc5a4d671
-
SHA1
76766b4fe69d3d8233c07a6ed8859de8350eb455
-
SHA256
e5cdcf5aa31780284148b2816d4bf34e3dab333acf7fe147a5c76c470412c8cc
-
SHA512
207ec5b5c9a1dc6b8fb2c63b447726ef8bd5dab9bf1c29fa7cbc6cafdcacc6f6aca683ed77a7e48862834b78f1b5496b2a77872f9b64aff5c6920d11a4a46f5d
-
SSDEEP
98304:A3IpuGGyJ7cGSbWuM/BeF/YD6VTWyJ/kZow34zetV0rcqR+ucHNvATY:Q2uKJ77O/88F0eWyJ4IScch1KY
Malware Config
Extracted
hydra
http://darpanelopezhovmany.xyz
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.jfyjuvzqy.wuimronyn1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5773ed9aefef333b1eab89ce1c6ad183b
SHA1aeac0f5b024d5f5791d57bdb3eec306c5aeefb71
SHA2567b637cdc491ca0bb16496a4f64179badf2d9d04ff998870c7d1bf59aad3286cd
SHA512b07a67557e2461b2d7266261ef071eefc8a627266efde66b8859c15c22ac8a32cafcba9d9196a330bd83851e650949e3ee1d0455911827b4f6b9c082ccba34b9
-
Filesize
1.3MB
MD531df0af56ea0b4a1dd04c7a4727ff351
SHA1dbeb9338e87584f921f1715d55a74ace9666cf39
SHA256d813e776ae5cb294bdf4c2204795ec88c69c2d85357990623176cc6aa707dbd6
SHA512dc5bea1d18075587664e1d7d82e8da4c1843c78b85f4bdfdcd7e4e9389e98aca88037f350794da550efdb69f70799315d56393b5ba144f3605fef60b59bda7d1
-
Filesize
1.3MB
MD5ad3592c1825e2b3ec6612cb9f8b895c0
SHA1053bb349d0d96aa24bf25bbf3007831a8455e55c
SHA256695fcd53592dc09bdb783020658d9e88a749fdef5e74e332f2262274ce7854f1
SHA51295a2231aa13944ecc27f892beceef34519768859d70c36956a1f18bfa6d3d64601810ffa3552c479a949294e25aefc803d6d722253f98585cbd0a4115b8f26c4