Analysis
-
max time kernel
148s -
max time network
155s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
30-11-2024 22:12
General
-
Target
e8c880d8cf95aa40d1b32411e81a58c603b728d390ea0c61abb8384604a777e2.apk
-
Size
4.4MB
-
MD5
835c6d0d6ee40bcdbf7715a462940aae
-
SHA1
1e18a1bce208a5972fa089c174f61d32657ab11f
-
SHA256
e8c880d8cf95aa40d1b32411e81a58c603b728d390ea0c61abb8384604a777e2
-
SHA512
d30d46775284f6b1588a06add6b4a380420b4eeab8e0825b05ab53c00f166970a936d0c065cbc83fcc5848b19117a5f4ddc14121941751b13c31cdd703f1af85
-
SSDEEP
98304:3VORWqxrpPX69tUbD+lc0yDZUpzTWQyp4lB+WDxPOf/otvXQ0S:3VQWENweD+loDSpfWQ9FOfgW0S
Malware Config
Extracted
hydra
http://samsamcevir.cfd
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.album.sorry1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
967KB
MD58b400fd76e2e7841b7260c7c28a0f388
SHA152e62fa39cc7de7058ab497b5e54329b52d87ffc
SHA2560e5f426e9f799c7e62b474a952e1f4e8f99a5f6eee0b389cb76e11a43cd93b13
SHA512eb23e1283f7fab6c023306ee9e44f8ba4a0ef6b91c803305589c55f5c4d3396172bf2495195e74f40236d4bd73426954210a2b078f0a83e07b8c26b3a6222fa4
-
Filesize
967KB
MD590d8ad1c466871e872c0f03cdd1233e2
SHA16cc6361f68a959cd21112bb5f88496daf0bde236
SHA256371346743188536d4a74e5d82d1b44f285ba7790e76533923d499961f755e68b
SHA512181c38600f7f240b119b2c903ee100741bbea0e293230009a479d218df3bf79570e1d860e0ff65f0f8e7f813e45175c054ce5ec43efed58a2e291ef2dc9d3d73
-
Filesize
1KB
MD50e353711cd3b5649d407165c91059938
SHA171470be6d0be5706874fd06b5a8e1a3d3088ce67
SHA2561622f4e6cc0463f68ea9c2e0ee03fb0ad6fa671d606e355a9e2e666252d49c17
SHA512bba4e95bbae6c5c1e28332c55fdc688a15e28b400071d504416ee4195a25d67ee0d2fb0b972b1ac32b2e53701287f4e43bd8172f054ef2dac9c1b27f0135fe08
-
Filesize
2.2MB
MD563acf41579b5f4aecf4edc869a4b285b
SHA1607e30f38d069c5f07f30d37af38b252cc837225
SHA256fc616a2a7d99cef1568800fdc080bece8987ea122589b2b347b0b698207e7507
SHA51226b17f086ab19408dc7ef2da6105e1f2ccf6add1f24b7c65499e4e75d46da3f2e2a9478c42a218e21a62f624034cfdac100900060eb653d1592292049a272f1d