Analysis
-
max time kernel
149s -
max time network
135s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
02-12-2024 22:00
General
-
Target
4dc1e7c87737a450336cf283417766eacaeaee8bc1dedb1f2524d4191483c911.apk
-
Size
3.8MB
-
MD5
d20b7519ff19be228e20ad06609cc86d
-
SHA1
2a92462aac86b8887075351d5c3b6c75df6c8ecb
-
SHA256
4dc1e7c87737a450336cf283417766eacaeaee8bc1dedb1f2524d4191483c911
-
SHA512
51e622255d68d3a3d8bff270155eb2a87a25f4ac9800f8bae2f28f4db56feab42ab50d5447e2b5fb617a38a1cb1cb1cd9e138ba1378fa0ad2478a42b108e986a
-
SSDEEP
98304:WZUaM8Qabd8tqhTAaEwsp4lm/1B2u9LzXQRtS0jl:WZFEabal32u9LzXQR7jl
Malware Config
Extracted
hydra
http://yinedegelde.cfd
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.sunset.movie1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
967KB
MD5a2e35aeeea660fdf39e79de84755c81c
SHA13e8250e67f1f4a2c58dbcd11681af8c5215057b6
SHA2561dde7a63f58f786d397a4edea6252b1989c331072036ad96fb70a5b6b8b0a25f
SHA51294d6cb9355a22715d3d0caaf018b70258fdd4b67fe82d10cbe7387e92596d58f1c172aa57f73d60d3c7d31cd6cd6e0b323c2366e414c135e0e716769eaad569c
-
Filesize
967KB
MD530f6063a5f0125dadd9e03677f9565b4
SHA1814635cf45e090e36bce5916207f2661b0628509
SHA256539201232f063dd0e22a010ba5b478b30e2159aeb8bab0b7dad6307e2490c338
SHA5120cf812ea9871fae429fbc3839d8725689c5e83bd5c78e3575fa4a4e3c9bbb6770b3f0066aa0cb3d921cd1ba10beab184f2ce862893f3d4b63a1cc5de45b692b5
-
Filesize
1KB
MD592dc213a3dae2e5b166fdac886bd6f9f
SHA1629cd074f5278d7ffd0018994d9493a90187ec22
SHA25625f400b4cfb56dde6f453ff18637c47c3bb85c0d006cb4907f05069028f2e01c
SHA512dcf391cdea8fa23a54afba712e4eb9592b740d14431285d5a46d71f638e4bc07bdb96d3a0ffe9ddd48e30945da6cd506403940660d31bd61685adc24d56fc645
-
Filesize
2.2MB
MD54034e1f8aa89126b0c0e6cfc12404484
SHA1e0367e78f3845bf73937059965a7660a6bd25355
SHA2561bafaecde9d220ef902aa4459eda70446896a596c0d5e597161de090ec81b461
SHA512a9ac2481dc9d11a7506c6267b62b3aaaf13a80bb3a78da976bf0c24683492caea1a94d5f27ce323bdd0f6ec3898b5050ced99d1f17d8f055eb69039b7ef1c7a2