Analysis
-
max time kernel
148s -
max time network
147s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
19-12-2024 11:11
General
-
Target
292b6e8ff3435540c5c08038a5bdb38b.apk
-
Size
3.9MB
-
MD5
292b6e8ff3435540c5c08038a5bdb38b
-
SHA1
6dbba2151d46e40e53db95e9b13b6909f21d82d9
-
SHA256
8d06809f05039a050b9635d6fd2a22648dcae4f8c5962a35233cbb1efed437a4
-
SHA512
bcb971abd0e9f58b8cf38edd4a3e4673d76d82d9162eac4288252c914cccb0bff0c03a4c3071156243a115bd506c615a19a749cbd995820efa940e89135589bc
-
SSDEEP
98304:pfy+2wcn9R5LIva11W5vBjJbIVekUJCL0wx:lU9oC1kJBDCAwx
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 4 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.rude.stamp1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rude.stamp/app_DynamicOptDex/oBERE.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.rude.stamp/app_DynamicOptDex/oat/x86/oBERE.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5becbf1d1e2ab80bd84d9abc4a1926784
SHA1499e267e537d1ecc094f60b07e54fca71491c39d
SHA256f8e55182f9092b24aebc857f21fd0abac829749add655e828e7cfd2d01c29d71
SHA512cdd25ed40c372bb3d55fc759dcecaf5839d05d784b6d22fb1c0aaa9760c2a00b20f78e11ce7f8af06b0741d1b7e0bacdac9bcadcef195745e6d4830f9f40067f
-
Filesize
1.9MB
MD50f4d94abed91a3e6cf3f59bdb53e446f
SHA1d3d13ca825171e01f7fad23dfaeb0321eb5a10cf
SHA256876270bb0879a2d6291f9ef75014d6367d0b959ae36f16088134cf9539284234
SHA512262eae496c91948fd1c2096a13165f0ad7b7e64570c40ddcbdcf2dedce55a170d5a1a9cc01568471e36857ee15e21469cde9460e9b826661d420fc4da9eec361
-
Filesize
5.0MB
MD522c44cd9c5067a3e6dfc38087ba55a57
SHA15678fa9bfc7bc203ab120928f16332f0ee559151
SHA256e159b2e101ec004d3d334fbece1be2b82a5a5b448eab694c2519e92ebafe3263
SHA5120ce6a6cb44a01ad69008fb7cf68f3b19ad0d63efaed87d99d8faed00c6264c9713fb1e37e49ea29154ab57db3520e8fff17acebfd4fae7355715a76b98ae4cf8
-
Filesize
5.0MB
MD510c5c7ee79684a25651ed7acd4004183
SHA17e9686ffd78e2d112eda3ada566bb09aa439755d
SHA256335fc3d13f9be5844768a4ce80bfd36dec66dc474ac7c34459a3dc3c59858000
SHA512807ded0e6e6cc63ac1b851cdbee8b6534c73757a3153d983aa65f640819b65f1cdba851e1bc690118a87ee3c2579351ddf726a0eb0d2d24cefcfd9a005067702