hirudo | d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d[.]bin

Reason

error processing APK: could not decode AXML: EOF

General

Target
d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d.bin
Size 19.6MB
Sample261110-l3dzqaee23
SHA256 d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d
MD5 eb06bb252af36b568dbfb93d3936d118
SHA1 1ada79c4a5a1321dafd08870339b3b8ac23238fd
SHA512 944cba7800a278fca8555c3f56be331dca2e17fa9c798b37751d2264e2ae553c58660c532e1a28b76fc590aa1a4fe4fb7c7c3d189b13b066cdacb923bf887ad5
SSDEEP 393216:remirJZAd4/YsKh0hNFIz4fmyC0X6vM4dwtpwN/VPzFAI5X6h:rxUZAe/YsvRdCZ04dwLm/BFA0g
TLSH
T17A271241FB45A86AF4B7933BAAF74231D2116C48AB43C7C7659873391EF7AD01F81688
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer hirudo

Malware Config

Extracted

Family

hirudo

C2

https://www.helloharmonyos.com/api/devinfo/addComment?deviceid=

Signatures

Family: Hirudo
Hirudo is an Android banking trojan first seen in 2026.
banker trojan infostealer hirudo

Android Hirudo payload 1 IoCs

resource	yara_rule
sample	family_hirudo

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d.bin
unpack001/vpn.apk

File Explorer

d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d.bin

.apk 19.6MB
vpn.apk

.apk 18.0MB

d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d.bin

SHA256 d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d
MD5 eb06bb252af36b568dbfb93d3936d118
SHA1 1ada79c4a5a1321dafd08870339b3b8ac23238fd
SHA512 944cba7800a278fca8555c3f56be331dca2e17fa9c798b37751d2264e2ae553c58660c532e1a28b76fc590aa1a4fe4fb7c7c3d189b13b066cdacb923bf887ad5
SSDEEP 393216:remirJZAd4/YsKh0hNFIz4fmyC0X6vM4dwtpwN/VPzFAI5X6h:rxUZAe/YsvRdCZ04dwLm/BFA0g
TLSH
T17A271241FB45A86AF4B7933BAAF74231D2116C48AB43C7C7659873391EF7AD01F81688
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android Hirudo payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

a90d4206e19aec0478a385046bbf820240e7477b4421ee7d418ff724e46a29f3

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.zoyatv.app

vpn.apk

SHA256 09848681e2ccf267eea6ada5f94932c1445d14c8d5cf9667728baa4e0e3306a9
MD5 9cf959df00412c74f458eb4be5e368d7
SHA1 bab0e99a707bc94d58956da55660f825e25b3306
SHA512 6954e81f81e5a466c7186b65ce6274dabcef2635845501b4fab16219673214feba7bd66d82aaa34c4e98fb1ef41a27c731b18cbfd9a500f96487e6c0d7f4f3ab
SSDEEP 393216:4irJZAd4/YsKh0hNFIz4fmyC0X6vM4dwtpwN/VPzFAI5X6A:4UZAe/YsvRdCZ04dwLm/BFA0l
TLSH
T1CB172241FB45D45EF0B7933BEAFB5231D0856C48A74286D7A9D873390AF7AD02F81688
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64

Android Hirudo payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

903c70ea197504a07a3be4aa6b836f9c28dcbc859b2dcf4f95049af4706f8b15

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

Android Permissions

d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d.bin

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.FOREGROUND_SERVICE

com.zoyatv.app.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d.bin

File Signature issue

com.erasdas.asdasd.MainActivity

com.erasdas.asdasd.PayCallbackActivity

com.blankj.utilcode.util.UtilsTransActivity4MainProcess

com.blankj.utilcode.util.UtilsTransActivity

com.cwmsk.rphrqig.RjUit

com.blankj.utilcode.util.MessengerUtils$ServerService

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

com.blankj.utilcode.util.UtilsFileProvider

androidx.startup.InitializationProvider

vpn.apk

File Signature issue

Sharing

Errors

General

Malware Config

Extracted

Signatures

File Explorer

d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d.bin

File Signature issue

com.erasdas.asdasd.MainActivity

com.erasdas.asdasd.PayCallbackActivity

com.blankj.utilcode.util.UtilsTransActivity4MainProcess

com.blankj.utilcode.util.UtilsTransActivity

com.cwmsk.rphrqig.RjUit

com.blankj.utilcode.util.MessengerUtils$ServerService

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

com.blankj.utilcode.util.UtilsFileProvider

androidx.startup.InitializationProvider

vpn.apk

File Signature issue

Android Permissions

d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d.bin