Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
16/02/2025, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7.apk
-
Size
4.7MB
-
MD5
19d608e6ae206d1201a73e260ae291c1
-
SHA1
c7de4d18c2c03d0167465af4dc52e4c42f782a65
-
SHA256
0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7
-
SHA512
9b9f63bb7d231ccb29a42b87cff4a4564749ce42b3265085e391d9a50991dc8bdfcf3af0480a6a2f2591590517a82ce556c1227d633f755d23270a8ab006cd91
-
SSDEEP
98304:6yGnvxA5rpV5it+P6dvQ/wto1SUKxRlv0A5mjv34dZGEeA8c5Q:5GnJA3Si6dI/wysDLFmj/qBeAbQ
Malware Config
Extracted
hydra
http://12123-123dcvmolded1235asd123sd-123dvas-we12c-21.org
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 4 IoCs
resource yara_rule behavioral1/files/fstream-3.dat family_hydra1 behavioral1/files/fstream-3.dat family_hydra2 behavioral1/memory/4258-1.dex family_hydra1 behavioral1/memory/4258-1.dex family_hydra2 -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex 4258 com.dknwqqcns.ondnaxnqp /data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex 4284 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex 4258 com.dknwqqcns.ondnaxnqp -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.dknwqqcns.ondnaxnqp Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.dknwqqcns.ondnaxnqp -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/contacts com.dknwqqcns.ondnaxnqp -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.dknwqqcns.ondnaxnqp -
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dknwqqcns.ondnaxnqp -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dknwqqcns.ondnaxnqp -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.dknwqqcns.ondnaxnqp -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.dknwqqcns.ondnaxnqp
Processes
-
com.dknwqqcns.ondnaxnqp1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4258 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4284
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f
-
Filesize
2.2MB
MD5afd83eaec6e5419f402cfb114af48f41
SHA10d92bb9ec82c43694319430178a45b9d2b8f2bf1
SHA256d127dbcd7ffd3c452be748eebef5ac45cf21029f96241a0c06d0f38c2ba5757c
SHA51294d5753321403495c4812e8549823b6cd3606f56436e80f123cb83aa01fff37570a498a4085c1f0f65a14fc5ab30344e467ffde2e69275bcf7daef9270f361f2
-
Filesize
972KB
MD5b60f12fb5f37e39b4b60408d21bbf54b
SHA1da0c4b1994553deed56e83eac6d947623269b522
SHA2560d6dc394d3fdb2b58b6c7d7ededdfd6a87d389ac0827f15b5d27205d347b2317
SHA512636b2bbae304a93d2731e47508e2c387ae29bc3df072c8571bf02d3b690ad912987323cfe56d98e3e977d0cb22046a0a9a6bd26f589dd0ef6b61516b976fdfe2
-
Filesize
973KB
MD5d3bc67e550c88553ddefe5dc26c4dad7
SHA103c936af0cab89a749db60bd94bde4d35c269edd
SHA256314e495c3ec6522387b88e60055c1d1981a8865e2c2b87c3b55c2786b2efe355
SHA5126b3781deea4923cdd46db5844620be50c89c18de9ec1d9e0f53e0cd498a512c8d3cc9441d1ba46ee7c3b4fe28ff1809c83581aba03273a6186112939c9a063d1
-
Filesize
19.5MB
MD5944e7b90ad43792e107c4d3b4fd2af71
SHA192e6639e96590d7f4deb46fc53019ae3056cf7ee
SHA25635b008e53e966d355f9448930a6c3a11aa97da7cc893679632dd543ad27facd7
SHA5121478ea2a93866a1e715ed242f0765ae0e6766e9ea2425520a6e1b7e0edecfe8557188b9b01d2b5a6d05d6a43d6539ab58a78a13ec2812cf315358c4fa9b5c0f5
-
Filesize
2.2MB
MD51f73c3cf4633376ae1f4da3805e6d23b
SHA151e08b05f0e916784668c59ef7c4bb0d321e2c0c
SHA2560acb528981ed36950e40d97cce591f31d6cf9e5632ec97db9fef5c82a366a4ab
SHA512c08139f44083fd73aaeedd89645c7dae182038a03ad2da62c66c6a74db529451ae7c2acfa0445405135b2470acf08344f2ed167789062856a67e4cd672ba5530