Analysis
-
max time kernel
149s -
max time network
137s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
02-12-2024 22:00
General
-
Target
4dc1e7c87737a450336cf283417766eacaeaee8bc1dedb1f2524d4191483c911.apk
-
Size
3.8MB
-
MD5
d20b7519ff19be228e20ad06609cc86d
-
SHA1
2a92462aac86b8887075351d5c3b6c75df6c8ecb
-
SHA256
4dc1e7c87737a450336cf283417766eacaeaee8bc1dedb1f2524d4191483c911
-
SHA512
51e622255d68d3a3d8bff270155eb2a87a25f4ac9800f8bae2f28f4db56feab42ab50d5447e2b5fb617a38a1cb1cb1cd9e138ba1378fa0ad2478a42b108e986a
-
SSDEEP
98304:WZUaM8Qabd8tqhTAaEwsp4lm/1B2u9LzXQRtS0jl:WZFEabal32u9LzXQR7jl
Malware Config
Extracted
hydra
http://yinedegelde.cfd
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.sunset.movie1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
967KB
MD5a2e35aeeea660fdf39e79de84755c81c
SHA13e8250e67f1f4a2c58dbcd11681af8c5215057b6
SHA2561dde7a63f58f786d397a4edea6252b1989c331072036ad96fb70a5b6b8b0a25f
SHA51294d6cb9355a22715d3d0caaf018b70258fdd4b67fe82d10cbe7387e92596d58f1c172aa57f73d60d3c7d31cd6cd6e0b323c2366e414c135e0e716769eaad569c
-
Filesize
967KB
MD530f6063a5f0125dadd9e03677f9565b4
SHA1814635cf45e090e36bce5916207f2661b0628509
SHA256539201232f063dd0e22a010ba5b478b30e2159aeb8bab0b7dad6307e2490c338
SHA5120cf812ea9871fae429fbc3839d8725689c5e83bd5c78e3575fa4a4e3c9bbb6770b3f0066aa0cb3d921cd1ba10beab184f2ce862893f3d4b63a1cc5de45b692b5
-
Filesize
2.2MB
MD54034e1f8aa89126b0c0e6cfc12404484
SHA1e0367e78f3845bf73937059965a7660a6bd25355
SHA2561bafaecde9d220ef902aa4459eda70446896a596c0d5e597161de090ec81b461
SHA512a9ac2481dc9d11a7506c6267b62b3aaaf13a80bb3a78da976bf0c24683492caea1a94d5f27ce323bdd0f6ec3898b5050ced99d1f17d8f055eb69039b7ef1c7a2