Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2578dc51496376b92fefcda8030621b1287d2347a82148438542a4ebdb9657c0.bin

  • Size

    4.6MB

  • Sample

    250216-1xasfaznar

  • MD5

    0d7bb33151d9a98973e47fe54a885eb1

  • SHA1

    0a6a1644ba3e459d1ccd949e4c55736a92c04206

  • SHA256

    2578dc51496376b92fefcda8030621b1287d2347a82148438542a4ebdb9657c0

  • SHA512

    99172dfbf2c7dbf8da541b154b5f29c1c489d5d324fcf491b3f5916a8b7602de1418e86b453aed455bdcc5f02dcc69fb371e7835f8b7e2951f14760df75524cc

  • SSDEEP

    98304:VffTfxT5uY19NmMy0dL5jTS4ovGniG3ElCGYlq9VvdravEXjvC:xfxT57bzV3r60i/lhiMvPq

Malware Config

Extracted

Family

hydra

C2

http://1231254123-123d34123-xzccv-1sasdqwe-123cvbe-dqwed.org

DES_key

Targets

    • Target

      2578dc51496376b92fefcda8030621b1287d2347a82148438542a4ebdb9657c0.bin

    • Size

      4.6MB

    • MD5

      0d7bb33151d9a98973e47fe54a885eb1

    • SHA1

      0a6a1644ba3e459d1ccd949e4c55736a92c04206

    • SHA256

      2578dc51496376b92fefcda8030621b1287d2347a82148438542a4ebdb9657c0

    • SHA512

      99172dfbf2c7dbf8da541b154b5f29c1c489d5d324fcf491b3f5916a8b7602de1418e86b453aed455bdcc5f02dcc69fb371e7835f8b7e2951f14760df75524cc

    • SSDEEP

      98304:VffTfxT5uY19NmMy0dL5jTS4ovGniG3ElCGYlq9VvdravEXjvC:xfxT57bzV3r60i/lhiMvPq

    • Hydra

      Android banker and info stealer.

    • Hydra family

    • Hydra payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Reads the contacts stored on the device.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

    • Requests uninstalling the application.

MITRE ATT&CK Mobile v15

Tasks