Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
157s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
16/02/2025, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
2578dc51496376b92fefcda8030621b1287d2347a82148438542a4ebdb9657c0.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
2578dc51496376b92fefcda8030621b1287d2347a82148438542a4ebdb9657c0.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
2578dc51496376b92fefcda8030621b1287d2347a82148438542a4ebdb9657c0.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
2578dc51496376b92fefcda8030621b1287d2347a82148438542a4ebdb9657c0.apk
-
Size
4.6MB
-
MD5
0d7bb33151d9a98973e47fe54a885eb1
-
SHA1
0a6a1644ba3e459d1ccd949e4c55736a92c04206
-
SHA256
2578dc51496376b92fefcda8030621b1287d2347a82148438542a4ebdb9657c0
-
SHA512
99172dfbf2c7dbf8da541b154b5f29c1c489d5d324fcf491b3f5916a8b7602de1418e86b453aed455bdcc5f02dcc69fb371e7835f8b7e2951f14760df75524cc
-
SSDEEP
98304:VffTfxT5uY19NmMy0dL5jTS4ovGniG3ElCGYlq9VvdravEXjvC:xfxT57bzV3r60i/lhiMvPq
Malware Config
Extracted
hydra
http://1231254123-123d34123-xzccv-1sasdqwe-123cvbe-dqwed.org
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 4 IoCs
resource yara_rule behavioral1/files/fstream-3.dat family_hydra1 behavioral1/files/fstream-3.dat family_hydra2 behavioral1/memory/4217-1.dex family_hydra1 behavioral1/memory/4217-1.dex family_hydra2 -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dfzmabwby.wbpjhioxj/app_dex/classes.dex 4217 com.dfzmabwby.wbpjhioxj /data/user/0/com.dfzmabwby.wbpjhioxj/app_dex/classes.dex 4245 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dfzmabwby.wbpjhioxj/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dfzmabwby.wbpjhioxj/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.dfzmabwby.wbpjhioxj/app_dex/classes.dex 4217 com.dfzmabwby.wbpjhioxj -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.dfzmabwby.wbpjhioxj Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.dfzmabwby.wbpjhioxj -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/contacts com.dfzmabwby.wbpjhioxj -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.dfzmabwby.wbpjhioxj -
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dfzmabwby.wbpjhioxj -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dfzmabwby.wbpjhioxj -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.dfzmabwby.wbpjhioxj -
Requests uninstalling the application. 1 TTPs 1 IoCs
description ioc Process Intent action android.intent.action.DELETE com.dfzmabwby.wbpjhioxj -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.dfzmabwby.wbpjhioxj
Processes
-
com.dfzmabwby.wbpjhioxj1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests uninstalling the application.
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4217 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dfzmabwby.wbpjhioxj/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dfzmabwby.wbpjhioxj/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4245
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Indicator Removal on Host
1Uninstall Malicious Application
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f
-
Filesize
2.2MB
MD560af84a82afae12ff7052f9ed9cce45b
SHA11be6ba4a975b25e3ebef93be009d6536c67541d1
SHA2561491cc9fd0391b238fbaacc492791dbb45be3f78536c008f55f8dd40fa80bccf
SHA512042a86513b26c08ed60d7395bcc65f6c2eda778951c5b6d20916704613b5fc414ccfd327f5583f15e67526b73636e8b6ccfa3e1ffe573577c1637f0ff719ca06
-
Filesize
972KB
MD5c5a37df3cf85474050e8306c056b9cf7
SHA1fdc72e443f1ecbd63890c8cc532dbcd7421196c8
SHA256ae0c7db4a2be86772c697bd9859c50965e8dd14c478db1691e7ba4c9d7c83976
SHA512073e97fe065b956f84f8cf9ad054052b41238a802f97fcc66ee5f0eae3ce3c9115d0ac33c4e5ee98f4d8ae88d29955e90c55c4903e7838f7a636b4153fecd865
-
Filesize
973KB
MD5f5f722a77c3b6a8d6d08f2cd27bf4fd6
SHA12bd365abf3d3066ba40a3019084fe864a9cd21d8
SHA25630977adf0b70feea783ef1e4b791a99647ab5628f8fdc841813ac8e441bbf5e9
SHA512019b20daf5c5279f06d2a26345355827a1de4617277e719583e8367a0bfed925b35c51ddb7c0e4e9b1d1495956ad317f0af82c8b6473acccc6df219d3e12873b
-
Filesize
7.6MB
MD50e31bef3cafa45b9713f6ef6570d9281
SHA18f448c322a22cd534ad5629783fd845b50aa7e9e
SHA2561e3cdeda1fac40d44262d35e0cf2774c18f664d746b3575938ac51a2daf9f767
SHA5122cc004c149eeb3d261dfd4f445fd0fd415f4b20c3a1f19078b8eb89bcd5daa4b2ca28ff043716dadfcdfdc6a259c836708e7e8c8e3a3b1073a45afe36361b6c5
-
Filesize
458KB
MD56de3e690c382de5794638aaa494b7cc6
SHA153ca6feba8d717f5be7d824bfff006d210e4d842
SHA256d567e9a338e981f21f219c14f3d4c0308b68945fd1e09356ea04d14909698407
SHA512504f346fec017d6210ae54cac7a631ce174444870b6220d8452b2f046a93605398b547427e2fff653c23a94b8d9603eb714e53ed1f81a699a4bfc796b88a2f50
-
Filesize
2.2MB
MD58baef889a368f8cb19bebeae7d8f3b4a
SHA1b0dfba45b92b9f744d9edcc165a372a894c82740
SHA25690e6bb116bf657fa32fbb1cb910a77d9d0ea98322bf0e197cc91ba6130f5c21e
SHA51236db3a208a60cef5decf9615462b691c165a302d06409ec67c2e7102837058530747e4da08827e697ad515bacecf922d3958ffe75faba78ccf8727c47a2a4d75