Analysis
-
max time kernel
147s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
27-11-2024 22:03
General
-
Target
f5bbba0e4961af38c7a89ff2af505c878f5cc8fa65a2fe93e9b8f8b437a96997.apk
-
Size
2.9MB
-
MD5
22e5ff6d7ca46c53247bcb13329f76ae
-
SHA1
d655b2d0f1ab786d098ccf8f5fc44acab358fbe8
-
SHA256
f5bbba0e4961af38c7a89ff2af505c878f5cc8fa65a2fe93e9b8f8b437a96997
-
SHA512
b5a40d7a508a0d376506b7373ee5c35b6d7c4d7df33c05c69d38465c9e949d39021e538d16335dfb7efcd5af6cf01741a88e1cd2eea75d6a683b25a2caba8fb1
-
SSDEEP
49152:Qg94TTRGh4c0C4XOuxdutMZNgDwYtPBvRrXyoc8Z5qgzem+WtmU7d/KDv+:kcANxdutMBmPB5Co5Z5AmbtFd/6+
Malware Config
Extracted
hydra
http://alinozecorkiyez.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.slight.random1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
967KB
MD5cecd38150706c992e694419fda8c4292
SHA1e1b038f6154522921f5c19380a41c41ad8655df6
SHA2564720e1a0fd813ba5a67ca2c93d258c7b5e3b2974494f49a56340cf9201ef0978
SHA5126b64223e9d3e1a7d48f9700440b19fcd8194ee4a9b04c2ee8f9512d9e382eac2a367428db6e860c37d53f91ae15588a9c747c74ea437d5fba3e90c2189def5cb
-
Filesize
967KB
MD5255c1b6a00614e18ca825a9df611af5c
SHA11bf907235bd882379db3e8fdc8b5266d2d1a2acf
SHA256a8aa7efc846ee4af35677ef6f4f2eb426e2f43061cf06cbd89a07e272cf92cb9
SHA512a84b33023a7823e96279d9827fecf1c81e796233c686e883a2dacd47192d8965bfc6503b0f25644ef1f08d92c5f18e97d4b6f713eb48826527010631e0f52bec
-
Filesize
1KB
MD56d7bb0e90a70aea2253d238df3710e98
SHA13208f0e7c8776994274c378967b82cc25f09e04c
SHA25662b6848c7fcc94def3a2a9887c9dff68355f36be9ea603490057c4d3937cfa38
SHA512e8ee6862ceac016fbe184de6b291d5fcdc5fdfd5cec0267aedf3e037bd89d3f417107adb57a6ceea7140638bd5bca10709fa96dc0292c3a99fd75e8c12778ad5
-
Filesize
2.2MB
MD59b55d10738463211e24e68320946d378
SHA1e1bcb41e0d310e9d56d7822badb94f03c06fe584
SHA256ec1cd5959efee9651b2cf187e391e7bd7bcc6a4321fa87d6848b539ef9a7c83d
SHA512d8d19be3f93ce8c502326d206929687c5b228a3437fb19950533512a62e684dfc0b1440379b5b52ea9c87285572c09eb80903096b036661fda1a3ecc74286c82