Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
28-11-2024 22:02
General
-
Target
bfc7f0f356ba9424c853dbbf07ad74afba77661b611214282e51796ff4e1e7ef.apk
-
Size
2.6MB
-
MD5
22b072ddcdfed676a88f6e1c265ef367
-
SHA1
7db43ad4ea7d19e4c2a813e61647f2890a467633
-
SHA256
bfc7f0f356ba9424c853dbbf07ad74afba77661b611214282e51796ff4e1e7ef
-
SHA512
9b8d04bc9c4afd5bfd7b0098d96886ab01807f062276511afb01fb8e9c3348fda9e707d1584c8df87b661c591c709229ebff42f693176575444d78f4fb45cda3
-
SSDEEP
49152:onwY+WAG9JOReya25PyhrfDX9WJvh7XiiYVE4RC/14BHFumweEjH:objGReX5tWph7Xdb14BImweEjH
Malware Config
Extracted
hydra
http://fhuiooedjefjheeffemensb.info
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.first.barely1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
973KB
MD5481fd83bff6e5d72cf771469aa4348dd
SHA177b076c4e957d2f56aa7b74629631b00a2c55cc8
SHA2562958f6e5648528884fd42e45e3c90acffbe7878c685ea5ad6c32797f57b28090
SHA512c6fb0024f7a5a10e3432184147829e1c9b1e592063222767925156705f95d199aff309d7cda144c7716a62a759518b413280e88561aaf8d294c19df69e07605a
-
Filesize
973KB
MD550e7d274ea242629d1ca2c956063c3e1
SHA12d9b1a97eaf1cf6c6ff72a56636ebf7e0a2cb7c3
SHA256fbbb106db51794104ce19a79ac2c3456cf8c3be1e347d05bc308ac7d5f7aa46f
SHA5129b1f78a1641912d195c1d958dfd12684f0742d6b9d72a901e73715313023760be5a13cc463798739218311d7c33cb6565b0b433f927c8c8db984f5ec36853c7f
-
Filesize
1KB
MD58fec3c85ac8e29303cb5988db653e1c3
SHA1ba914783d509b2368bba00619957a99ef7c1c21a
SHA256f46b8e6bede8f55275a66ba4d50e82d87bb562dc03975c54a52c3675d5c1c215
SHA51238388233e0244e3d60cfbd3d62efbdbe368256f801e6da607dede2705626fe95e180c70857622db2b2a89ae8f4440a228100e12064d224771a097cb57d727f58
-
Filesize
2.2MB
MD59511d3bcdabe0e7138fd9dc8185881b4
SHA1d3290356217ca41edcda30b01e79d9a6b490ec65
SHA2561c0d9620b48ed806d48230d4431400f24e46c0d29cb8df700d120dc06ab24fc4
SHA512189215be0e5d6a0652c8dc8802a957419210a39c43b9664404c73dbb8f6c0009a3904eaf28982bab744e12c7a9aa9d363e20fc14521e257c3fa240dd94e37dd8