Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
27-11-2024 22:03
General
-
Target
f5bbba0e4961af38c7a89ff2af505c878f5cc8fa65a2fe93e9b8f8b437a96997.apk
-
Size
2.9MB
-
MD5
22e5ff6d7ca46c53247bcb13329f76ae
-
SHA1
d655b2d0f1ab786d098ccf8f5fc44acab358fbe8
-
SHA256
f5bbba0e4961af38c7a89ff2af505c878f5cc8fa65a2fe93e9b8f8b437a96997
-
SHA512
b5a40d7a508a0d376506b7373ee5c35b6d7c4d7df33c05c69d38465c9e949d39021e538d16335dfb7efcd5af6cf01741a88e1cd2eea75d6a683b25a2caba8fb1
-
SSDEEP
49152:Qg94TTRGh4c0C4XOuxdutMZNgDwYtPBvRrXyoc8Z5qgzem+WtmU7d/KDv+:kcANxdutMBmPB5Co5Z5AmbtFd/6+
Malware Config
Extracted
hydra
http://alinozecorkiyez.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.slight.random1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
967KB
MD5cecd38150706c992e694419fda8c4292
SHA1e1b038f6154522921f5c19380a41c41ad8655df6
SHA2564720e1a0fd813ba5a67ca2c93d258c7b5e3b2974494f49a56340cf9201ef0978
SHA5126b64223e9d3e1a7d48f9700440b19fcd8194ee4a9b04c2ee8f9512d9e382eac2a367428db6e860c37d53f91ae15588a9c747c74ea437d5fba3e90c2189def5cb
-
Filesize
967KB
MD5255c1b6a00614e18ca825a9df611af5c
SHA11bf907235bd882379db3e8fdc8b5266d2d1a2acf
SHA256a8aa7efc846ee4af35677ef6f4f2eb426e2f43061cf06cbd89a07e272cf92cb9
SHA512a84b33023a7823e96279d9827fecf1c81e796233c686e883a2dacd47192d8965bfc6503b0f25644ef1f08d92c5f18e97d4b6f713eb48826527010631e0f52bec
-
Filesize
1KB
MD5c9ace6f6927304cfb06593531301134a
SHA160243aba126f730a77873fe5e81236456dfc18ba
SHA25650e449532e3f73a998318099af2f20f44d2f919719de94900a8e5594bd2e2df0
SHA5123b64fa2ae576d5040d138ba0f09a4bf416bae76cad2db95d800018ba4a1cf4048985e8bd39a0f4b4873b84c32d80ed58f56798ca7e72d9001e26038536169e36
-
Filesize
2.2MB
MD59b55d10738463211e24e68320946d378
SHA1e1bcb41e0d310e9d56d7822badb94f03c06fe584
SHA256ec1cd5959efee9651b2cf187e391e7bd7bcc6a4321fa87d6848b539ef9a7c83d
SHA512d8d19be3f93ce8c502326d206929687c5b228a3437fb19950533512a62e684dfc0b1440379b5b52ea9c87285572c09eb80903096b036661fda1a3ecc74286c82