Analysis
-
max time kernel
148s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
27/03/2025, 22:16
General
-
Target
8147c1b4ca19e7bd0dd9f7866fbda3495f378bd94b903a5db9a8f52bc1aea76d.apk
-
Size
4.5MB
-
MD5
df1060078eb031d5e66f7f3a4bdc9cb9
-
SHA1
f748299bf1067c6784dda59842720c2e217bc249
-
SHA256
8147c1b4ca19e7bd0dd9f7866fbda3495f378bd94b903a5db9a8f52bc1aea76d
-
SHA512
c7c687304fb294f17db0c3a3670d3a0935ed04cb5cd1e485a20d78afc81574055531106caf3d483ba3208de7b959ffd7e833242fc1c035fbe21d6bafed42206c
-
SSDEEP
98304:+8zDmmytRTWqA/e42JFbbGfNqsE5bCKLyNndn2BLr8wdX:+8zDmpDTWh23JZbGfO+oyld2RrRX
Malware Config
Extracted
hydra
http://wahwedbontonz30facezconiboesd12312sergag.com
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Hydra payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.grprjaftg.qotgmafug1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Reads the contacts stored on the device.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD545ea2b8f52a6fbc82f6970fae1830efa
SHA13cb9ac4cf0acee1765b5fb4e961efdca147b4ecc
SHA256317dd1a2f2e4610a2f3e7c5e9f597043f11ed1fe49249910a21fef83ab7511d4
SHA512868de8d63a17796cc4a8f13a15ed5339f0d918575306090bd23c2a4c9de583e0f9e5970d21a2dc44c3ef71c815621d09d9c25cbde97c5aa8e2c11d0b9aa1bbb3
-
Filesize
1.3MB
MD525c4c93944bda0df211ff7623d420aae
SHA193bb9aea4fc9262fa9fa09e71dd2c252d2587c8d
SHA25610f7df597456f0d40122c6d9a3254163921501decfbae640bb0941f4c3fd3b2b
SHA51270eacf7295e962e3f2065e35778ad0db7fc1f69f35c8676ddde4e08fa3f125dd56ad0175b829ae5b42d1d8185660b6cb88add1de26d5a878c25bc116d4e9be34
-
Filesize
1.3MB
MD55dc3b08bd2aadff0a662dfbd86ef1159
SHA166fe1aad96a0c23db9f6b8e58ae563e2ea67947e
SHA2568be9accd815dfbbd13067a9980596b612f46ab274b625c3096d2c8fd1b4222aa
SHA5129c2d57bc47a4dba385434cd4a375c3cfe8150553cabf16f73832625f8e9859874b2b3ce9cb03be0be797bc1b6a7d4daee1fc03d2361c1f5cd36e91cb6e5c478d