General

  • Target

    b01865490efb9a6f31ba51e13c12af058495115f70843b96848c6f48f840d6a6.bin

  • Size

    3.4MB

  • Sample

    241129-11v8jsymev

  • MD5

    9061a906c7dee4902963016e1dc4ac66

  • SHA1

    89d08c046dc4a901efd8b634c13e29bbb1d644a2

  • SHA256

    b01865490efb9a6f31ba51e13c12af058495115f70843b96848c6f48f840d6a6

  • SHA512

    0e60b4e11651f7c017afd3c2ff9966508e0e468eb39c50e9cbb480c7015dc3c01f37a09e4aefb96613c10377c437eb89dcb82bfcdff3a205c5fdb3bb6c907bc2

  • SSDEEP

    98304:gFy3jnKlgClzBCRdU7DefqtryDYH1Dh3VgcBTfvT+Pt9RPxZKcchsT:gFy3jnK/lz2UtWc5T+bRPxosT

Malware Config

Extracted

Family

hydra

C2

http://samsamcevir.cfd

Targets

    • Target

      b01865490efb9a6f31ba51e13c12af058495115f70843b96848c6f48f840d6a6.bin

    • Size

      3.4MB

    • MD5

      9061a906c7dee4902963016e1dc4ac66

    • SHA1

      89d08c046dc4a901efd8b634c13e29bbb1d644a2

    • SHA256

      b01865490efb9a6f31ba51e13c12af058495115f70843b96848c6f48f840d6a6

    • SHA512

      0e60b4e11651f7c017afd3c2ff9966508e0e468eb39c50e9cbb480c7015dc3c01f37a09e4aefb96613c10377c437eb89dcb82bfcdff3a205c5fdb3bb6c907bc2

    • SSDEEP

      98304:gFy3jnKlgClzBCRdU7DefqtryDYH1Dh3VgcBTfvT+Pt9RPxZKcchsT:gFy3jnK/lz2UtWc5T+bRPxosT

    • Hydra

      Android banker and info stealer.

    • Hydra family

    • Hydra payload

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Reads the contacts stored on the device.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks