Analysis
-
max time kernel
148s -
max time network
154s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
21-10-2024 22:02
General
-
Target
cf61fabe36b8e414e9a68e45527e59f479febbb5a5063c5615b0ee7e264cf9fb.apk
-
Size
4.4MB
-
MD5
08c28b133e548fb3635ab74076e565a5
-
SHA1
f04f1e62ae4bf2af4d976d25946abe1e242740ce
-
SHA256
cf61fabe36b8e414e9a68e45527e59f479febbb5a5063c5615b0ee7e264cf9fb
-
SHA512
6419d3a571a60fd19452e0420b00da0d309add7f46c9fe0a865dbfd654e9c0cc0c2db1d300a1b38f84b69ce5efd4621ad073ccd16f79fbceab49382c7f76099f
-
SSDEEP
98304:veaIDq984A4UaWIgJ4Bltvf3TENVZVwMa2gECLj060LeJuPvgNaQtyMT35u4snJt:FIGzA4OIgJ4BltnwbZLa2VCLOLeJungm
Malware Config
Extracted
hydra
http://haluksamu.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.xqdslasfp.dhfldpzsi1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5d5e3a97540633d2500dd849b9e4f5166
SHA1bb82f98ec463a77f1b355464fd3f14038c355d49
SHA2567305fddee36ce521c99c1bed73c4c951e5f18b2a1629441f865d6c94effa8786
SHA5127244fcfd47b737e9b3bb926c552cdd4fdc5432f1f4b4554f0937cfabbdec671043c674bf5735a4bb72b67e9505e11b553257261a0813359436e73dbe191f4717
-
Filesize
1.3MB
MD5f6961af86b8e684183b14d7449065e24
SHA1f91ecdbd68493762b3e970ab5c01886a2f331f4c
SHA25612a5d10fcd276aa0eba7788ee20e8a58ffb0f903d52d17e31b4d3edb32a43d17
SHA512347f96d105670b93ba59447ca832f229ba4cf7d2a098892e5444d792634d501a97d6314a413f787edc8bac36bf19521ef5096be952355bb9de2c8c222cba6f23
-
Filesize
1.3MB
MD53cf9313c5ed85ddfc36b44517a768bea
SHA1c27c6843b565fe1c2a3179ecac83647f3fd1f1ba
SHA256491988d6d5149aaed121d89b4ec6feddbc090c26c42b8e35e9582ef5dfa8d068
SHA512585e110e408e196a6fe8e65f1d9a752db21620ea1b0f362426e9696d6cd6afb6b516f0e958fa4b51741cfa01faf05fb4749c9489dbfad21c1e386da8db1be27b