Analysis
-
max time kernel
149s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
01-11-2024 05:32
General
-
Target
8421a95ea4edfe3a06cb6c78db58848b_JaffaCakes118.apk
-
Size
3.0MB
-
MD5
8421a95ea4edfe3a06cb6c78db58848b
-
SHA1
7b31ba4b4b2b5971ddbc812689c8ac28f28bd2a8
-
SHA256
77b51738442f4d1b388db76db05388bd358b19f21c1f663e7993f9e32a7d6278
-
SHA512
aaccf4c3343a3c0218b62e8545baeb8f2c3ebc1401001844303bb4f3d75b45538c7a99dc01482ee79990bbfe5bedd9edc27c614931d30f5a244488acbc409bb1
-
SSDEEP
49152:v+afhiOsnVv0VdZNg6ieo3jGkIuFMEh4X64AKdA90Y3xnb5n5UgQCVSHn:vdf9aVv0Vd7rmXIWRj90WFusV0n
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.whbjegzv.oxvzbms1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.whbjegzv.oxvzbms/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.whbjegzv.oxvzbms/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5a5ded51395a12d262442d786b2489d3f
SHA1e584d450b9fbee2a6b6febd8986c21290c309a17
SHA256f2a379e750e2a0934b919d32a612e653c03b722d133956f0145dbd2f20cad37e
SHA512827a76b1dda74135824b3774054785e3d8081c52ae91011d5667aa42c7d2c61c863069e7dd19b11873d5887a31aacfed9e153d42c838acf041631d888ba8f755
-
Filesize
902KB
MD553a1f6a9e903d61e4ec2daea31f8ea7b
SHA18babd0a00ac3bb155a12de4fbe33224ce4f90ceb
SHA256e80d747c238d4f713bb3a8782f1783495a06cd74db1bd3ce5eccb1c85c7e6bec
SHA512df7afc3791849b7e2acaac66a82b2a9ef838c397ea8d7c8086c18266ad42e3b8ebf8409ae180b1f91ae8dc93921722b6de19321a2c4e3fb01913c75a23f4e1bd
-
Filesize
902KB
MD50513aa66ad0c5dbb6fb8a683718c95a0
SHA13a88fafe95ff98b03ed7135eba6e72ed621e8e8d
SHA256b7ee7aabc058d6662c43d349c3768ea0952547b9b23962e1730aa434687e1f66
SHA512b34ff787b9b5ac8e06e8985be95e1662b9c98f664af50355bb4fbd14a0f643d21ecef240d8e3a8fa169d9832b02acfbc53087953470a1b4a84576e272445f5f5