hydra | b1a4be5c6a8eff345e9f6ad4bdc52b7f01ab0f5aefbb802e826058a0547f50e6 | Triage

Resubmissions

28-05-2021 11:22

210528-rbz3kyfpqj 10

12-05-2021 05:47

210512-jsw7nexrce 7

Analysis

max time kernel
2998427s
platform
android_x86
resource
android-x86-arm
submitted
28-05-2021 11:22

Sharing

Report Analysis Logs

General

Target

40895_Video_Player.apk
Size

4.8MB
MD5

63ccd6c2909ade6167815f7a1b542382
SHA1

24800575be8b387f4e321caf67a6e26f30b91a82
SHA256

b1a4be5c6a8eff345e9f6ad4bdc52b7f01ab0f5aefbb802e826058a0547f50e6
SHA512

ce2b74329acb900988e9159578139566a6c1815d237115ef36ca2ddaccf4ad3b3ad48b46e291642c6a86a65c35a3fc4ba84a03beb62d9659bf5d781c471d254d

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4720-0.dex	family_hydra

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/angry.risk.excess/app_DynamicOptDex/ICJN.json	4720	angry.risk.excess
/data/user/0/angry.risk.excess/app_DynamicOptDex/ICJN.json	4760	/system/bin/dex2oat
/data/user/0/angry.risk.excess/app_DynamicOptDex/ICJN.json	4720	angry.risk.excess

Uses reflection 1 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4720	angry.risk.excess

angry.risk.excess
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:4720
- angry.risk.excess
  2⤵
  PID:4760
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads