Analysis
-
max time kernel
149s -
max time network
154s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
27-11-2024 22:02
General
-
Target
439018bf4c08f0b13d1992e5a24d87c345d177621075de1d521a2932169fb850.apk
-
Size
2.4MB
-
MD5
5d60681e1f341a7119ac0f6f95c934c1
-
SHA1
100b74d7f0e4a9a1b712a14216f0a2a5535ed8d8
-
SHA256
439018bf4c08f0b13d1992e5a24d87c345d177621075de1d521a2932169fb850
-
SHA512
3f97db8714328d6c4bf6866e6c6579ae3e603952bc1bf4d3ab66db149270c8d74e6ebb58bd29c36c6ee2e1299d381d697f5fd3e33efd2bc3506b22e463b9336a
-
SSDEEP
49152:dg94IT1PKjAnuBDNPuBS+sAmeisC7hLAHJRGakCRUyysCM7X8kioI5LmrlKCmw8:6UjAnuBDMNsXeisC7RApRGt9yyb6TbYr
Malware Config
Extracted
hydra
http://alinozecorkiyez.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.gloom.gate1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
967KB
MD5088ae0e3e287382b6f16ea7d3f7f7f3a
SHA1d91ce165c2c273109e67db8c912911137ab86d85
SHA2563d300f6f67fade002fa04944fbadb0b63b9ee1e35ff67eb70d1bd4614bee7ca7
SHA512297d8aca8f6c54d9d3de58fe27946462a250d416e83872fe464b6f680d23a40f4bdd97ea0c29505c305055427af4c3ed114ef4e98e06d4003be38b662e0f19f5
-
Filesize
967KB
MD57bcde0273f7370e74ccdbc24ccbdaba2
SHA16b402910d4baa48df63d99041e11ae2e4eab3007
SHA2562458b73f597e4e3bdda4994e037d769e13d94e0ee095aa88c9893599c3084c58
SHA512d7dba7b0e530aaa94a732df092cea589548cc68cfe1f311a00782a56e67a1e50d9bf1d7e654d19e89a01a53c8e3a59433035b120d08245a67fd93d8bbaf033c7
-
Filesize
1KB
MD52a85c6b06e85c118cbb3763650f352ee
SHA1486ee9e0c66cca3573c0c779d6d587a5261a4397
SHA25626a9cdd5afcde2ea2c6be694a6e5d7a81c9203ab65b2619eb1bcffa225449815
SHA51250996a87256484fe63c883b43a57f49d7292c3b91d69169c8dd251c9aa42fb2404f197a5a2f1c6d3dfc093da68d0334b662110164b709b26bc846c1acae0fab4
-
Filesize
2.2MB
MD59b55d10738463211e24e68320946d378
SHA1e1bcb41e0d310e9d56d7822badb94f03c06fe584
SHA256ec1cd5959efee9651b2cf187e391e7bd7bcc6a4321fa87d6848b539ef9a7c83d
SHA512d8d19be3f93ce8c502326d206929687c5b228a3437fb19950533512a62e684dfc0b1440379b5b52ea9c87285572c09eb80903096b036661fda1a3ecc74286c82