Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
04/02/2025, 22:09
General
-
Target
f190b0887265d7e7fbef7ce328180aa11925295e0fe335efe526747acb64449e.apk
-
Size
4.7MB
-
MD5
97582d8e33578e7dd5f7667bde68f6c3
-
SHA1
71356471f1fc8cccd4288deb577d63041e1faea1
-
SHA256
f190b0887265d7e7fbef7ce328180aa11925295e0fe335efe526747acb64449e
-
SHA512
e624188eeb55dc230a9bc32b60965331a3f60cf8a05eb5cadc25147ca672ea3a863617dc0dcc1fba0cb57c06b1fbadd1ebb6b87ece49cc57ad1982e2bbde9ab1
-
SSDEEP
98304:/H7JYwx4LmDPN5WWs5s5GShHjq35Uf6X9HsgIFrBCbg+jccUr6Abk03LbUg+:/exw5WWsjH8Mg+k+
Malware Config
Extracted
hydra
http://chililiki0101.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.glare.cruel1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55df2d50324a43db085d312bb0d12f133
SHA1b464cb59c975117344c7275a084ac1171aa1ae1b
SHA256c299a8bb4bf409b110e09bb6d5b07e90de7ddac4a95164cb753a19d160a6a244
SHA5125beaf02adba7b78e52b072de62a6767cecd3874e57800d2d8bbf02107463a21b6e265d8585035fe32e23fde7c1b8086152f24dbe6b4b26cf92c21521f296d3c0
-
Filesize
969KB
MD5583141cf8aa68a0301559f61cc07fb53
SHA1ccd52b32f39769d4b1371a7c21c25ba68fd7c95f
SHA25631f27d50248d86d62f8c1479fb59d4dd4ce5ee6b425164fca998b63e94edd24d
SHA51275733eb8edf9e956db228aad0437f05e158a4d73b8b85db9d87d596302f9e54534a77789e473d034a19b23c57197b54d422a9079f62533172ef7fca2fe794bcb
-
Filesize
969KB
MD56e1e4f034f0d4f2d2763319ffb8093a1
SHA1ab15fb85fe29a9cebe66082b6c94623f70db9987
SHA256cf41cac9bcc747ea77d9242da6d2572bca052d4eaa012b50bad6630fb7676a11
SHA51232f02ea29e6b16850ea4e6852ed9ade03bc6da962dbb75d997d0cc616122956e1f2bc638104c1b30d7a319ebc3f3457e896bae8a55c2d1ee1f16931a7eb0fe52
-
Filesize
2.2MB
MD5ce7d6ddfc5b2e4b2c8287cc5819c0882
SHA100fbd32820aa35a0dbd0629eba9aaee2a52c99cc
SHA256158eb42ab0f86c5c715a12f26f4fa11d456c72e3534f7a096a6261a427d2c628
SHA512f164ef89b01f80651cfb0b884b86591e29bcefeea2b4e481234577d17ccd0cca98e29099bdcf8f3090af3030a9adb020c0b4089b2ef6ecfbf35f60ed6ef53a01