Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
05-12-2024 22:03
General
-
Target
83fe65fe0364b51e440e84d2ce4ecff8fefb7ff6f923e187e296da7b2f3674da.apk
-
Size
3.3MB
-
MD5
e6a82f097295699f542e5eb3d9eea835
-
SHA1
e157688ce2a6bd7cd01dacea5e63271844ae2348
-
SHA256
83fe65fe0364b51e440e84d2ce4ecff8fefb7ff6f923e187e296da7b2f3674da
-
SHA512
be0e6a4cb0077f38d48610f2ffd4c2eaebe068cb66894c076790dff6d28e1418ce53673652084dcabd4d9deece965756a9c2da978aed833bd74ca8b0a5f52e08
-
SSDEEP
98304:sldd9Mci2YsDV3WKPc86efqtryDYH1DK+M9xhf4w:sl6ci2pDV397
Malware Config
Extracted
hydra
http://yinedegelde.cfd
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.version.injury1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
967KB
MD520e89fffd6e59b46c37ed6445be18e7b
SHA1fd2235cf49aa56ec93e4a830511f1b5e3e3f3f44
SHA256f666d771ba87bec2d19fe2e9e6f5c291cdb892d1fcb3da326b66ec58f299aa46
SHA5121b4f244a0bf1a45a10f0c2044b92bcdb36ff63c0e9f806dc68db7f1812034da6db50df428c382e1c9366b68fd4f61f6629e5ef15af64d66f5221f873c5975fee
-
Filesize
967KB
MD5cb6e8b93ee089be8b86efff7311bdbed
SHA1c2949d8bc9d3900d9f9daae303b96b2d630148eb
SHA25633d78d802a0915f32dd0a0e709cdff7e901f34e0bbe6e674d78850e3429192bb
SHA512de1a95d68936f1239e9a35ba424446799f37a32cd6a5bd6654f1e94235fcd065d066d0330790c894e9c32b043e29b1f66feb0c3af260d77726fef8d41e2df633
-
Filesize
1KB
MD561492bfc32c2aa4aeeecbbc344f16c98
SHA197a734fb95b4443b4b4b54dd737c750e147a1a93
SHA256e427c740adaebe852f3c02bce5d5bce649d79d947eae1d44e230d647a839b6f5
SHA512c9ad75603c033de95a26454804e00e0c423ac31a7df1708041743b2f65a7173f3178c847330e6b9f00c4018c4657cc2d47625040f074afe2cb1bbb758f6b21bf
-
Filesize
2.2MB
MD54034e1f8aa89126b0c0e6cfc12404484
SHA1e0367e78f3845bf73937059965a7660a6bd25355
SHA2561bafaecde9d220ef902aa4459eda70446896a596c0d5e597161de090ec81b461
SHA512a9ac2481dc9d11a7506c6267b62b3aaaf13a80bb3a78da976bf0c24683492caea1a94d5f27ce323bdd0f6ec3898b5050ced99d1f17d8f055eb69039b7ef1c7a2