Analysis
-
max time kernel
144s -
max time network
146s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
19-12-2024 11:11
General
-
Target
292b6e8ff3435540c5c08038a5bdb38b.apk
-
Size
3.9MB
-
MD5
292b6e8ff3435540c5c08038a5bdb38b
-
SHA1
6dbba2151d46e40e53db95e9b13b6909f21d82d9
-
SHA256
8d06809f05039a050b9635d6fd2a22648dcae4f8c5962a35233cbb1efed437a4
-
SHA512
bcb971abd0e9f58b8cf38edd4a3e4673d76d82d9162eac4288252c914cccb0bff0c03a4c3071156243a115bd506c615a19a749cbd995820efa940e89135589bc
-
SSDEEP
98304:pfy+2wcn9R5LIva11W5vBjJbIVekUJCL0wx:lU9oC1kJBDCAwx
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.rude.stamp1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5becbf1d1e2ab80bd84d9abc4a1926784
SHA1499e267e537d1ecc094f60b07e54fca71491c39d
SHA256f8e55182f9092b24aebc857f21fd0abac829749add655e828e7cfd2d01c29d71
SHA512cdd25ed40c372bb3d55fc759dcecaf5839d05d784b6d22fb1c0aaa9760c2a00b20f78e11ce7f8af06b0741d1b7e0bacdac9bcadcef195745e6d4830f9f40067f
-
Filesize
1.9MB
MD50f4d94abed91a3e6cf3f59bdb53e446f
SHA1d3d13ca825171e01f7fad23dfaeb0321eb5a10cf
SHA256876270bb0879a2d6291f9ef75014d6367d0b959ae36f16088134cf9539284234
SHA512262eae496c91948fd1c2096a13165f0ad7b7e64570c40ddcbdcf2dedce55a170d5a1a9cc01568471e36857ee15e21469cde9460e9b826661d420fc4da9eec361
-
Filesize
1KB
MD555e52e639266c57f736e77c4be1b1f13
SHA11d29064756f442e715b2e5aaeb9bbff7b8959ccb
SHA256d3f6cac154218cd46a07096fc43d1ae9695428067b899033e802963803964abf
SHA512986fea669090447479fc43eb09024b11ad2b2412788130352a8b88e7298325c3777e6490298a5cfba9806ae6439d24bd2b06e52c31d0d568c003e23287d65966
-
Filesize
5.0MB
MD510c5c7ee79684a25651ed7acd4004183
SHA17e9686ffd78e2d112eda3ada566bb09aa439755d
SHA256335fc3d13f9be5844768a4ce80bfd36dec66dc474ac7c34459a3dc3c59858000
SHA512807ded0e6e6cc63ac1b851cdbee8b6534c73757a3153d983aa65f640819b65f1cdba851e1bc690118a87ee3c2579351ddf726a0eb0d2d24cefcfd9a005067702