Analysis
-
max time kernel
148s -
max time network
133s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
15-11-2024 22:07
General
-
Target
3bd89198a415abc6de842e82a422a3819dc26ed84e570c98910dc6705efba682.apk
-
Size
2.9MB
-
MD5
fb1d3d89bfa11dfd4017f28fca3a26e3
-
SHA1
a17278137e64b9b376a52d8ef9f42c2990364a7c
-
SHA256
3bd89198a415abc6de842e82a422a3819dc26ed84e570c98910dc6705efba682
-
SHA512
b0b5a02f5381ab4ea2d0f2fe8997b05c41fc97a11fa585f41f78ab01cc790140365998bb3571c2ab3d62c187abb910b8a8f46dbba3a75f52bb94baee5359704b
-
SSDEEP
49152:Ey7JQ6guM1JGiurriuDxkHd1jdMfgwcILqp5+fL7NCOmOLVfSmQ40LDeqVOpN2:37JQ6gf1JGiuBDxkvizdIMBCYLxQ40/f
Malware Config
Extracted
hydra
http://cioroapapoldoapolawe.org
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 10 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
Processes
-
com.test.despair1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD52be958ccef8fb2a7082075fe10c76c20
SHA10c12a61d32d4f9b5ea996b08dc790875683d3e37
SHA256fe589a7ed53d6f0befefda2bc439409789ebd8b67d7208d6eb8cb433955bd870
SHA5129f211e1affd37dcbdba59d6da7b5745207c230aca099cce12cc288a8585eb9fa1c80e2d98cf3da6330ac33747c7c35dc4f5fda96f95af9a156a95c3b885e47cc
-
Filesize
1.6MB
MD5f94417b1a5c34abcfca9edb4bb7cf2d2
SHA16abf11e0e8771bd1cdaa2c90f2adab7817e391a3
SHA25605335a6c6ddb8289adac9661d9f5848fb737de1231cc4f6ce32f0d39fbca408c
SHA5123c094a0aacf62d85fee2bac8c25eb933f334c60e4f16ff86ffb7cb42399b62a8c0cb358d60b6209b5902495db58474a16501c995e9ee73c594cce759484b789c
-
Filesize
4.4MB
MD5d3d49b07b35aaf5daf2c9ee5624604f7
SHA18aeecfc8e17dfb725de8eae50ec6f8fe2d9b32e6
SHA2562bdb4588932674b78f9ccf5d4540cc04a71524dc7061f4ff5a37e11097ee0e76
SHA51299bd23a52249f35b38c18aad5b9f4f9a3b924c4d66bbdc00409831943917b77910d253b6447a054ff89b901b719cd3c561f72ac16e3c4cc970ef872acf08cb89