Analysis
-
max time kernel
19s -
max time network
156s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
19-01-2025 22:05
General
-
Target
ab63d402d65fc74eee11e03ed1a36b98c192c5b4e52634754de281db9cfdb704.apk
-
Size
4.5MB
-
MD5
dc1f2c17bf1f1e75b3342d94d4649cf6
-
SHA1
09cd1e7ba65d383e537a1b650a2bfa79680531dc
-
SHA256
ab63d402d65fc74eee11e03ed1a36b98c192c5b4e52634754de281db9cfdb704
-
SHA512
cfced9450a7918068b4bf3b2e4f469f3fbe5290e3a3631f3ef39a7ff4131c6950df9d8a20c7af361b1568174554156b362be1df2d8523fab69241d7208c9d3e5
-
SSDEEP
98304:WpSkWkIT6WhDmNibtSytfVMPtCibixzFOnRX/AMm:uSkAT9h42SRPtCeBIMm
Malware Config
Extracted
hydra
http://ayfilopconbeydolcaneydozpahped.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.huosycrnn.ouiqieelc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f
-
Filesize
2.7MB
MD5d27dfb63f482e471dd5d133faa1789d7
SHA1a3529c823aa12d5179c9732217d5b09d157c39ff
SHA256dcb1fb8e8200fcee34ae7903fea55cfaf42c16566120545554a530ef119b07d5
SHA512c54d2f34333f127077845aab9b3f73fdef6ff7b3ea51ec2560ed671ed27506564d46eea02598a688e4bdd91d3c186a386d993b593a291d198808ab32d47abb22
-
Filesize
1.3MB
MD5d39dd91ec0dd37d1cfae982bf44c41bf
SHA11cc31435da5589f8715e5197e1c02acf23718281
SHA25669b7cdb3cb607a803443eb938a7911148beee2798517c3f7d74b15d05cf23246
SHA51235465aa0716d4de7ff6aadd8a9335c0611c6100613eda7a90cc044ae086aaeb08ce7dbf8da896ed3b7f979888dfe7fff79d191b526d39a2f90238454c1cdf94e
-
Filesize
1.3MB
MD5fe5c0672b8fbdc3ca0fd3f7c2d23a234
SHA1bc7d900a830a432a4fc3ac507144986d4b7456ab
SHA25616d36e2638223234cc0d2de9a38985d39c49f3f281b1bb00d635eb77b2ec3ad1
SHA51217538d042921c438e2b58bc89baed6a0f36bb2e717a133861605377ab7415ee8c17c8863fc4cd48f5197bb31d45ee3fa1f92ca3f8efe54dce36e110dcf9df930