Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
18/02/2025, 22:05
Static task
static1
Behavioral task
behavioral1
Sample
0ac01342238f475847397de2111f20ea443814a5c7b72a62968a95edf9eed96f.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
0ac01342238f475847397de2111f20ea443814a5c7b72a62968a95edf9eed96f.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
0ac01342238f475847397de2111f20ea443814a5c7b72a62968a95edf9eed96f.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
0ac01342238f475847397de2111f20ea443814a5c7b72a62968a95edf9eed96f.apk
-
Size
4.7MB
-
MD5
0775e24eac481f4ed132564fcc21d4b0
-
SHA1
fd860721a4ab81a47bfa8e7429c54bf093b3303f
-
SHA256
0ac01342238f475847397de2111f20ea443814a5c7b72a62968a95edf9eed96f
-
SHA512
120ff44a3339c1d840b051f689461d58bde3e7ea0519b5b7c6981b180d9b4a08ed569a3c075e3c7480511cfb3100c6c49f5ad9131486796ba276167ea26674a5
-
SSDEEP
98304:ZnMqWn/bFYwLVxCYAlQe+me+qERR8DgLg+WKLENzXteuZgVMhxQes8Y+zc:Zn1Wn/ZYwLfCYArFe+qEEDijeztUMTJi
Malware Config
Extracted
hydra
http://12123dkjeqwfe578-123sadcxcvx-123qweas1-23cxc-321ds.org
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 4 IoCs
resource yara_rule behavioral1/files/fstream-3.dat family_hydra1 behavioral1/files/fstream-3.dat family_hydra2 behavioral1/memory/4260-1.dex family_hydra1 behavioral1/memory/4260-1.dex family_hydra2 -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.sghhyiokv.tnqjbkqpl/app_dex/classes.dex 4260 com.sghhyiokv.tnqjbkqpl /data/user/0/com.sghhyiokv.tnqjbkqpl/app_dex/classes.dex 4287 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sghhyiokv.tnqjbkqpl/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.sghhyiokv.tnqjbkqpl/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.sghhyiokv.tnqjbkqpl/app_dex/classes.dex 4260 com.sghhyiokv.tnqjbkqpl -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.sghhyiokv.tnqjbkqpl Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.sghhyiokv.tnqjbkqpl -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/contacts com.sghhyiokv.tnqjbkqpl -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.sghhyiokv.tnqjbkqpl -
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.sghhyiokv.tnqjbkqpl -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.sghhyiokv.tnqjbkqpl -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.sghhyiokv.tnqjbkqpl -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.sghhyiokv.tnqjbkqpl
Processes
-
com.sghhyiokv.tnqjbkqpl1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4260 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sghhyiokv.tnqjbkqpl/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.sghhyiokv.tnqjbkqpl/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4287
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD53baeaa766ea7f31a9147208efd957c75
SHA1c701de3d0e55425394ccbf8e0967639e86f3c54e
SHA25675e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d
SHA5129f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f
-
Filesize
2.2MB
MD5acd1f9dc6141981aa233eb9c256dfa40
SHA1bc1daac3eef0ef48f0389a1ce83468ee26971531
SHA2565d29ebc852a33dc7f48de1a5d0a0b17a2499a167c672c650e2fe32c45f2bc910
SHA512c4ef9ea5b28d6da312bc216598cb8ce778b8ea8fa197051b97e59ecd8f7c1f24672102a4f610d2cff1f61e097ce7f713753b37aa64a72d8a4e6c5613c14df17f
-
Filesize
972KB
MD50bf2245ac6be5d3781495202ec92b2e0
SHA1d18dbea813c05c7b14f1411e9938e2879ddaa739
SHA256d7e26fffbbecf9965ba7d227eb91c6e0320704fe3baf5ef9b26a6999eb25a666
SHA5120bc3ee01f3ec5aa9de13afa1f0886c274a3d086876233747c8a75d979c10c8ca47c145d29ee29b870185f0362b0d63233343f098e830635cd8810055c32428b0
-
Filesize
973KB
MD56c8d0a3a5756d1f3b5c34f5d24928082
SHA1fb3b1ad42e67f378b5754ed6d5b60c04a0750342
SHA256d8edeef04ad9077d65e61256734fad8f64cdddef261ecec0288b7b8585526413
SHA5128ccafc75ce970022aee97e9a96e040fbe39e5c89d19fbfe118dedf50149104b2c31165635275808340994200701131ae84da45074390c39f3a39439b12717965
-
Filesize
47.0MB
MD573ad8bd52eece30cf7789c6e83d011d2
SHA14d4f48ac678d621b5ed7107136084e9d9932b0de
SHA256ca072ec4465aa39e4e3ffa28b13dae23e25e7dae7cae59a529095408a7f00538
SHA5122ade35a3709ce07242d5075ae20e4eb9352bc8d52a0042a43d93c526bb10d72d0b995a4166fa2152737f89fe941c4f0ec59c1dc1e2ccb0f19f9904eeefdeede4
-
Filesize
2.2MB
MD5563e40f72b9f1b61afdb475bfc4b989f
SHA1c61b931e65d2bd6e7cb3b2536ff1419483b82564
SHA2566c8591e1391218d508160fce275f1f21a61f51a17114b8d61edb96e185f252dc
SHA512b57ccdbd2610b7e6d340b746ad4f5b33afa541c9dd1af440a1c931ac751c35488df3ba9b47813049d0323c27b11fdaa2829b7a0ff0fdadff5b575bde58d82c76