Analysis
-
max time kernel
148s -
max time network
142s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
05-12-2024 22:03
General
-
Target
83fe65fe0364b51e440e84d2ce4ecff8fefb7ff6f923e187e296da7b2f3674da.apk
-
Size
3.3MB
-
MD5
e6a82f097295699f542e5eb3d9eea835
-
SHA1
e157688ce2a6bd7cd01dacea5e63271844ae2348
-
SHA256
83fe65fe0364b51e440e84d2ce4ecff8fefb7ff6f923e187e296da7b2f3674da
-
SHA512
be0e6a4cb0077f38d48610f2ffd4c2eaebe068cb66894c076790dff6d28e1418ce53673652084dcabd4d9deece965756a9c2da978aed833bd74ca8b0a5f52e08
-
SSDEEP
98304:sldd9Mci2YsDV3WKPc86efqtryDYH1DK+M9xhf4w:sl6ci2pDV397
Malware Config
Extracted
hydra
http://yinedegelde.cfd
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.version.injury1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
967KB
MD520e89fffd6e59b46c37ed6445be18e7b
SHA1fd2235cf49aa56ec93e4a830511f1b5e3e3f3f44
SHA256f666d771ba87bec2d19fe2e9e6f5c291cdb892d1fcb3da326b66ec58f299aa46
SHA5121b4f244a0bf1a45a10f0c2044b92bcdb36ff63c0e9f806dc68db7f1812034da6db50df428c382e1c9366b68fd4f61f6629e5ef15af64d66f5221f873c5975fee
-
Filesize
967KB
MD5cb6e8b93ee089be8b86efff7311bdbed
SHA1c2949d8bc9d3900d9f9daae303b96b2d630148eb
SHA25633d78d802a0915f32dd0a0e709cdff7e901f34e0bbe6e674d78850e3429192bb
SHA512de1a95d68936f1239e9a35ba424446799f37a32cd6a5bd6654f1e94235fcd065d066d0330790c894e9c32b043e29b1f66feb0c3af260d77726fef8d41e2df633
-
Filesize
1KB
MD549621babc21632ed97dc76fb6f2ee507
SHA125b91c342a8ad6c39950ba88b3b7846a145f9410
SHA25648b144e0577521b0a4a9d0e9e828785d7c4ae95b0e0ead798db7525a230c915a
SHA512fc9221884f61d12353757f898b72976ff74d64ed15e7c5c1c342974f04f7ce628bfb9d8c4b05a7b2c5dcdaf514690af14d528516df49fd1e66fd7736da6826bd
-
Filesize
2.2MB
MD54034e1f8aa89126b0c0e6cfc12404484
SHA1e0367e78f3845bf73937059965a7660a6bd25355
SHA2561bafaecde9d220ef902aa4459eda70446896a596c0d5e597161de090ec81b461
SHA512a9ac2481dc9d11a7506c6267b62b3aaaf13a80bb3a78da976bf0c24683492caea1a94d5f27ce323bdd0f6ec3898b5050ced99d1f17d8f055eb69039b7ef1c7a2