Analysis
-
max time kernel
5s -
max time network
46s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
07-11-2024 15:34
Static task
static1
Behavioral task
behavioral1
Sample
736d8db012c57ba3112fe1f1f36179f8.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
736d8db012c57ba3112fe1f1f36179f8.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
736d8db012c57ba3112fe1f1f36179f8.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
736d8db012c57ba3112fe1f1f36179f8.apk
-
Size
1.5MB
-
MD5
736d8db012c57ba3112fe1f1f36179f8
-
SHA1
463da75abac1fca2145b81e696ae4daadcbebf86
-
SHA256
50bc07a96900cef9d191466ed5a9cdd5181df49621fad1cbbf296b8746d2969b
-
SHA512
bb966be07a35c0eca816465e40e62f292c59b54fb1eed3b9b250f757e561743073faa44a8573559ddbda87de59ecf3563fc520a1b19b53180ea2682701ecfe3f
-
SSDEEP
49152:jTvRcaIgrvZwJmI30fpSBk8A71b6zwS4qyEjy:v+a/JIawBkH5b6QEjy
Malware Config
Extracted
hydra
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
resource yara_rule behavioral2/files/fstream-4.dat family_hydra1 behavioral2/files/fstream-4.dat family_hydra2 -
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /storage/emulated/0/Android/obb/com.grand.technolite/dp/classes.dex 4933 com.grand.technolite /storage/emulated/0/Android/obb/com.grand.technolite/dp/classes.dex 4933 com.grand.technolite /storage/emulated/0/Android/obb/com.grand.technolite/dp/a.a 4933 com.grand.technolite /storage/emulated/0/Android/obb/com.grand.technolite/dp/a.a 4933 com.grand.technolite -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.grand.technolite
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
297KB
MD55cd1cfcd474a2ca77008e5d6330e3cfb
SHA1eedcc4d5f8cda0827ecf5e3345661daf215a8610
SHA2566e6f1da5ca4a2c105c685d8d9fdc4ef6024b933a620eb3585fcfdbc3fcfc100d
SHA512ea30a29839e7e93457c1816e1fdfdfaa924f50da0fe3cc2022bb6f7c04b62eea6bd86a0b92b1a915cdfdb32e30c5b94ad8d3d7cfd8b5b3f8d6452b0cf1f7d90a
-
Filesize
2.2MB
MD5b5f45eeb2b1e59223f4623df3d8e442f
SHA177856f51e4cc2110b4afc2169fbb791fdd4661e9
SHA25600bbd8b24b9eb28ff854a2c56b79aa46fd757121b58328bc81504649d3e5a2ee
SHA51228562204e37a7b6629a99721d856b44220e026866c66fa50d232829af2929dc22853e20b8c019b528abbbba026eba3a2ce10c95c6666efee764669747c617f49
-
Filesize
68KB
MD5b4e08f78556c360ae1d7c6d838a5af12
SHA1110c7b66187f7d277b50ebe5839982313d14e4c8
SHA2564b15391f3dd8091a7a54a63125871d1a18458f27441c9fa04ec66e3f7d49dd7f
SHA512b9fbdd5a0256e90925cd01efd84a14060c6024c788986fa54794cd8b2d35d5eefbc438387c419c48af0429994da975d3e777035081f1f0dcc72aad31bcc3fa2e
-
Filesize
1005KB
MD5c8bcd7111d7c4afe0142bc7092e693e6
SHA1fddf9a40fd0b845884accb946ee73a2613ecec3c
SHA25612973c19a4e5e8b173a761dc700615b01d7c2853a6c59318d393b25cc1e97954
SHA512daa1b010360f221c76caf8516fc2ccbd2466baa725813237919f85fbd1e2ecfea667810cf0388a8c4a2e210eb1db89af08ff3cf45b01badc82b0993a01cdfdd9
-
Filesize
963KB
MD59848d5c443cf567279f7331ed82b2b9f
SHA112586ecec8ee473922c149fa1d1aede78517b39d
SHA2561278e1b8dddf0bc049a106a85a60fec6d7f5de6ed4887fe9092a334e10a07341
SHA5125cb3e7168356f2a58d44a8efa30ec6f93dfb4e71f9ac7d4d9989e5b6ebbc735aa7caf25fdba045fd9581cb64e6d8b2620c5aa0c3d030adbae7af354afc7004e4