Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
02/03/2025, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
5d6ab41098430b0f2079cd0bf715a7d59eacfbda9f743e25dacd6037f79ef0ed.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
5d6ab41098430b0f2079cd0bf715a7d59eacfbda9f743e25dacd6037f79ef0ed.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
5d6ab41098430b0f2079cd0bf715a7d59eacfbda9f743e25dacd6037f79ef0ed.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
5d6ab41098430b0f2079cd0bf715a7d59eacfbda9f743e25dacd6037f79ef0ed.apk
-
Size
5.0MB
-
MD5
355bc169ce558d9c5ddf2e192e002c8b
-
SHA1
15ffba7b0c956c86608cc335712b1d568c7da159
-
SHA256
5d6ab41098430b0f2079cd0bf715a7d59eacfbda9f743e25dacd6037f79ef0ed
-
SHA512
bf4694b368908a65d8fa751584ef2cf5c854caf627baa54a37877aeaa8d61d22aa6cc7b9cb02c9df00b4e0aaf5ab50d75981d9dbd3745e1142aa6c2af4b8a3fd
-
SSDEEP
98304:X25fdW7wo7fq3yyJd3FEy+/CQeVavSYYEDZmqLSgPQC/ijhFwo:myV7fSJxUBeV0SWZTP7sFwo
Malware Config
Extracted
hydra
http://45.83.20.56
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 1 IoCs
resource yara_rule behavioral3/files/fstream-3.dat family_hydra2 -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.expreyopf.fknecmswq/app_dex/classes.dex 4786 com.expreyopf.fknecmswq /data/user/0/com.expreyopf.fknecmswq/app_dex/classes.dex 4786 com.expreyopf.fknecmswq -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.expreyopf.fknecmswq Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.expreyopf.fknecmswq -
Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/contacts com.expreyopf.fknecmswq -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 28 ip-api.com -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.expreyopf.fknecmswq -
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.expreyopf.fknecmswq -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.expreyopf.fknecmswq -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.expreyopf.fknecmswq -
Reads information about phone network operator. 1 TTPs
Processes
-
com.expreyopf.fknecmswq1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
PID:4786
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD576920a0b90d047a55843c84228cd0549
SHA13ee921de8e91967f2d5f73e5c41481a31c0f00bb
SHA2563177589064e8a2509b1fb33b91dd0cb9c1497370b02cca906b762584be8aec86
SHA51258353fe2c4b466191bc516b00c87052bda587401d3e116b5ac6668257f3fd62c72894359f1bfdb3e16fc5727b4d668d99ac1342c88a4224fc9b682d660f0de5d
-
Filesize
1.3MB
MD53f7126be688b7e18031b9d0d0fc5aa7a
SHA10cf5650d6f2a586bb5fe223ff685e19aa350a697
SHA256f643715932dbd49cffdca761ab81617f1f76cb000446b91719727679bbb4b1b0
SHA5121b7c66d9ff5828284b0f68da5a5f975d35a088196661073421a956fdcbdd7cf011f3cfe1a35b8e1c6cf4008f11b69c0403004d27b7ddbf09806fee4c888464a9
-
Filesize
1.3MB
MD539094f79dad11a21ee75ff43a5d2eefb
SHA103be0f5703936c6a3b475357e6de2cbe6cc9e12e
SHA25689c6572f194f438055d4151beca28682d67e1e54d30e8d10f81a012174751a63
SHA5120562fe6dbd971c2520e947e8a18acb0681a2abe54b0b931985e3e2ff9b268e6c33fc9f19ac51af8a4cb284699eaadd0a7492a8539979306d9028cdf895b1dbed