General
- Target f6da0d9f1d74f2f80cd4d69183a78ccc1b3679689419262c9704787cea754726.apk
- Size 7.3MB
- Sample260819-arax5stdqa
- SHA256 f6da0d9f1d74f2f80cd4d69183a78ccc1b3679689419262c9704787cea754726
Malware Config
Targets
-
- Target f6da0d9f1d74f2f80cd4d69183a78ccc1b3679689419262c9704787cea754726.apk
- Size 7.3MB
- SHA256 f6da0d9f1d74f2f80cd4d69183a78ccc1b3679689419262c9704787cea754726
Score10/10-
Family: Hydra
Android banker and info stealer.
-
Android banker: accessibility service abuse with overlay injection
DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.
-
Android dropper: runtime DEX/class loading of a staged payload
Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.
-
Contact harvesting with SMS self-propagation
Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
-
Silent screen capture via MediaProjection
Acquires a MediaProjection session and pipes the virtual display into an image reader or encoder, enabling continuous capture of everything shown on screen including credentials and one-time codes. Combined with accessibility auto-approval this runs without further user interaction.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
Network activity triggered a Suricata alert
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
1System Checks
1Discovery
System Information Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1