Analysis
-
max time kernel
77s -
max time network
85s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
11-12-2024 15:33
General
-
Target
a8e7c5ada0ad61b47187241ff1be82212a3f1260087d4276f22658ed66a07990.bin [MConverter.eu].apk
-
Size
4.9MB
-
MD5
c9db7b7c68e3f4b3ea7bc6d2db7e6c67
-
SHA1
21f29a3bdafe66b9d9a4a0900f87ae0378c2af4e
-
SHA256
a8e7c5ada0ad61b47187241ff1be82212a3f1260087d4276f22658ed66a07990
-
SHA512
d1b4e39dc0b7d39465d64f3fb774fbfe8442ff66d52f2380cf550d2e82838cda33e5dbd6d4a443db964746da309ce3add0d9db884adb2848028f641cd65cbe11
-
SSDEEP
98304:Ftpb68BpwSSih42NbdUGDIJ9wWATD6V7sq/2wsA2OC6OKQv:75TBgih4IbDIXwWk6VYi2dP
Malware Config
Extracted
hydra
http://cabmeldtpgabrilokez.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.vpdmkbfdr.hclrvjtqr1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD59fcebe6ac01f9abcb9358ef3e1be01f8
SHA10c99f46ce1bfa1cfa76a0e30d27c822029db1659
SHA256ab056d7cd8db1977da982d9a2dd8258015120e3cb3ced1abf105ca6e36d724b9
SHA512192c075908f5c18acec27d8b7dd62220727213309764eca391c2d4b558b34cb76eae09ad8aacefe9d9ac46603fe220e685d55e587260881c0247fe6def6ef8c3
-
Filesize
1.3MB
MD5198e249fc4cb7eebfb3aa41c9bca936b
SHA162739a33b597f5f817868c31d76189c34f2a8ce9
SHA2568ff952de0092bbdbd15695e7c6f9b5137015c71f0762edc89417f4cc9d67108a
SHA512cc1b1d9fc44daacb892900b2b17b93db8cb4880e705530d3aeb444b3c7fcda6a4a59266a4c5d56266942b0568bc09ae08f7572c74f8272a3030d210c4b36b6f8
-
Filesize
1.3MB
MD5fdae72c7dd1658f5582bb244648dcc72
SHA156eb6eb1252e0dc7eda9784c49b81e0a00f6d920
SHA256831d26600070e587aca3567bae1a092e77808aecdb6c3ada2d6e3a00d2dd04a1
SHA5125cef1ab17b14497b6a7f4beb1cd8fb424c7962b845597bc833395c49bc79b32d4fd49b862767dab29efdc660ae39e1a99f5b8e1157e1430ae5d312ebb20ca95e