Analysis
-
max time kernel
149s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
07-11-2024 13:11
General
-
Target
0d0d156f5634762f031711fc868181df736843c42f057ee728e7c82bf04f0cde.bin [MConverter.eu].apk
-
Size
3.7MB
-
MD5
a3cd10e11f6188244488d93b6777e7c3
-
SHA1
418b6432f823868b33bccdf641267f5d6a8497d1
-
SHA256
0d0d156f5634762f031711fc868181df736843c42f057ee728e7c82bf04f0cde
-
SHA512
fa7b52c2d9a4517d379be57912182d2ac5033cb2009eae90a3a3bd1de1788f41bfa74705f77a0d2b31198610aeb1505db9112860491ccc3dfe78968d3a906611
-
SSDEEP
98304:uI+vBBTxBNTEjp5SoVSqZEmSKsq/ZgCke+fakXDRTbc:p+vB1xBK+olVSyqNf9zRTbc
Malware Config
Extracted
hydra
http://tahrakamezlokez.net
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.aiynakeuf.qubtahrys1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5ead75b1a695e38e1045b773cc215867f
SHA1260c1a1da0aff308478eaf3cb16e60f9f47a53c5
SHA2563c9731c5854d0c1cab47e0cbc4811d70c0cf74a7153c23e07c4984ce82d4a171
SHA51297fde7046f5fde6c8daabbc8f9948a18263d9041504eb76c30c0b6686cfac3c7a0f62f41919d7f7aebe989ecd1f02f1f25515d5a545c03b1e8c0ed105e7755f7
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f