Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
16/02/2025, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7.apk
-
Size
4.7MB
-
MD5
19d608e6ae206d1201a73e260ae291c1
-
SHA1
c7de4d18c2c03d0167465af4dc52e4c42f782a65
-
SHA256
0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7
-
SHA512
9b9f63bb7d231ccb29a42b87cff4a4564749ce42b3265085e391d9a50991dc8bdfcf3af0480a6a2f2591590517a82ce556c1227d633f755d23270a8ab006cd91
-
SSDEEP
98304:6yGnvxA5rpV5it+P6dvQ/wto1SUKxRlv0A5mjv34dZGEeA8c5Q:5GnJA3Si6dI/wysDLFmj/qBeAbQ
Malware Config
Extracted
hydra
http://12123-123dcvmolded1235asd123sd-123dvas-we12c-21.org
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 2 IoCs
resource yara_rule behavioral3/files/fstream-3.dat family_hydra1 behavioral3/files/fstream-3.dat family_hydra2 -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex 4627 com.dknwqqcns.ondnaxnqp /data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex 4627 com.dknwqqcns.ondnaxnqp -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.dknwqqcns.ondnaxnqp Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.dknwqqcns.ondnaxnqp -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/contacts com.dknwqqcns.ondnaxnqp -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 ip-api.com -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.dknwqqcns.ondnaxnqp -
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dknwqqcns.ondnaxnqp -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dknwqqcns.ondnaxnqp -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.dknwqqcns.ondnaxnqp -
Reads information about phone network operator. 1 TTPs
-
Requests uninstalling the application. 1 TTPs 1 IoCs
description ioc Process Intent action android.intent.action.DELETE com.dknwqqcns.ondnaxnqp
Processes
-
com.dknwqqcns.ondnaxnqp1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests uninstalling the application.
PID:4627
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Indicator Removal on Host
1Uninstall Malicious Application
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f
-
Filesize
2.2MB
MD5afd83eaec6e5419f402cfb114af48f41
SHA10d92bb9ec82c43694319430178a45b9d2b8f2bf1
SHA256d127dbcd7ffd3c452be748eebef5ac45cf21029f96241a0c06d0f38c2ba5757c
SHA51294d5753321403495c4812e8549823b6cd3606f56436e80f123cb83aa01fff37570a498a4085c1f0f65a14fc5ab30344e467ffde2e69275bcf7daef9270f361f2
-
Filesize
972KB
MD5b60f12fb5f37e39b4b60408d21bbf54b
SHA1da0c4b1994553deed56e83eac6d947623269b522
SHA2560d6dc394d3fdb2b58b6c7d7ededdfd6a87d389ac0827f15b5d27205d347b2317
SHA512636b2bbae304a93d2731e47508e2c387ae29bc3df072c8571bf02d3b690ad912987323cfe56d98e3e977d0cb22046a0a9a6bd26f589dd0ef6b61516b976fdfe2
-
Filesize
973KB
MD5d3bc67e550c88553ddefe5dc26c4dad7
SHA103c936af0cab89a749db60bd94bde4d35c269edd
SHA256314e495c3ec6522387b88e60055c1d1981a8865e2c2b87c3b55c2786b2efe355
SHA5126b3781deea4923cdd46db5844620be50c89c18de9ec1d9e0f53e0cd498a512c8d3cc9441d1ba46ee7c3b4fe28ff1809c83581aba03273a6186112939c9a063d1
-
Filesize
316KB
MD58b22e5e2f4046f6d34e6436ffb6fdb52
SHA1902c91eec0e61402018d282d71d7f4def1bca84a
SHA256041159c10f6ed125bfc893e22db5cc39b16f000f88970950685d9160fb0363d7
SHA512a90b2e4f5a3ca0adc2c1ed1ad1e08f6051bbd4981bd6c3bd727951dd022a7c3fa1efee229b3912c2f303468eca318f047bc54bfc8b9391058fa54d0077981b31
-
Filesize
17.5MB
MD56333969eb2b6a7dea12b08a6b6d40920
SHA1d799729164133a86712c4fbd6e340190ce1cf2e5
SHA25678056258ca992ca4711583597fe97a9f7f950c8dfc47355052ca4c25acd18782
SHA5126d1647dc33ab2d75160729ad7d71f5392e0dcc6eb89880afc9573bdd5249e114adfaf89cbfb8614fad3b0a8c35133607b0f64609337ccc7b42daaf1abbf6fc41