Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
04-12-2024 22:12
General
-
Target
1bd5a87911ce556674bf76de66c323d8a912e119c0f50c545fdc4c11c906c408.apk
-
Size
1.9MB
-
MD5
dcb49e8b437261ca4368711333229f58
-
SHA1
edc8daf2c111c80fdd5bfbe422b0a2a000b7ce47
-
SHA256
1bd5a87911ce556674bf76de66c323d8a912e119c0f50c545fdc4c11c906c408
-
SHA512
bedf7c71e614c381a6728840da9cfc7c566799779bfc05cfc676cb6878d2f39d0a7e9c8a73729800e00d28cf6c256e4941a09e1e622ded774f556b1d763d7700
-
SSDEEP
49152:D5kx/5EwkgqvkPKHTwXov51RXJWUe0Ej6H:VG/5EwkvvkyHT2e5TXoUe0Ej6H
Malware Config
Extracted
hydra
http://ihfwiohefwhiwririhererf.store
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.visa.know1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
973KB
MD56e93804ab1b0aa1fe58f309c3b95b58e
SHA1f2f028bed4fc2a65f39508850795df56b47d83ab
SHA2560a4322c703157cf603abf3fabb534968b0199b3302a0342dd129f726c2005597
SHA5125ee6494ef865d949bd3df0df504a1968cef01dfc53723ecf44304e5afe727dc526572fbf4664f32a9244507dbcfac4f2544d66c631aa71888f6ec612d66ff932
-
Filesize
973KB
MD57b70b2c6bb0da8648410f507e467454b
SHA1d58486c8d491d652e07c89a362041e144e45bbbc
SHA256b17eae8e4c5fc91db2aef5afc0f2c55a061a5c9785efe3ceb422c8c985e71d47
SHA512ab4cc90caa652ee5752748a6d25e19af929432f5e6257b9e61a9e4cc05d6dbc58f33cbe1eab0df27ca9cd1a2fecd005306c95d4af7eabfe9ef651698c7b18fa5
-
Filesize
2.2MB
MD5937feac0d8f8dc1f87479c0c4b276bf2
SHA179a1b8b582f2f4d0dcfea5514a9a35f72cb2268f
SHA2561aa3f15395e87d4c2a8403e5364372c967b27a39108697fda08b39855ee06981
SHA512b9b65947e045f0b92c6832b838682d0c996712bc23d629f2212e696f2774d6d924976225adbc59169f1dfbc542674d92c9add611b0d97cc91ed82d803a69bb53
-
Filesize
1KB
MD5e29e34a15a07db46d7e2e0eafd0e68b5
SHA1676b9d5d2351fb47a8d89f5491c050ce00337223
SHA256a9e284ea7125493b9313bf58b216b985d715c4db524fa367a2a47620f6341923
SHA5120283bfcfb02ab3d6b62cfe54a740e69fd42bd0f0ac39b5f9e0036717c049816ab09e219c78a0f45d46a635da76fbdeac4fc038b4c8bfe3cf72f2c5a042d0c647