Behavioral Report

General

Target

Vodafone-Netz.apk
Size

4MB
MD5

43245acd2bfc4fb651961933a72da0ad
SHA1

37b5b34250fe930132de9c4bd9efd1b6e5f3f0fa
SHA256

c393f0f03013dc249481462e58fa90c2cec561dc5cf4f9687930d1da8460bcbc
SHA512

d4ea92b758dcecba74309f31d17d54a1e9c9d4e2e3efafe6b05e3028d85f87fb501c90b1d3d9836c2bfa8362edd913f641efd0176d79fcd61fb15d4247eb6667

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Extracted

Family

hydra

C2

https://sendmehere.site

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra
Hydra Payload ⋅ 1 IoCs

Processes:

resource yara_rule

behavioral1/files/3608-0.dat family_hydra

resource	yara_rule
behavioral1/files/3608-0.dat	family_hydra

Loads dropped Dex/Jar ⋅ 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

legal.advice.rigid

ioc	pid	process
/data/user/0/legal.advice.rigid/app_DynamicOptDex/FJTIZ.json	3608	legal.advice.rigid
/data/user/0/legal.advice.rigid/app_DynamicOptDex/FJTIZ.json	3608	legal.advice.rigid

Uses reflection ⋅ 3 IoCs

obfuscation

Processes:

legal.advice.rigid

description	pid	process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	3608	legal.advice.rigid
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	3608	legal.advice.rigid
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	3608	legal.advice.rigid

legal.advice.rigid

Loads dropped Dex/Jar
Uses reflection

PID:3608

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

/data/user/0/legal.advice.rigid/app_DynamicOptDex/FJTIZ.json
MD5
176b0149a0edd8497b8ce47da5bded0f

SHA1
e3f6924c93e17bfb48c3f9b9c1ebcc067c355d04

SHA256
4a6c409a0126c6ee43644d9f304e1676b47397d48dacb73aa14ad21489769b96

SHA512
c5023df2dd812995bb006dde0c103d1885e53b6b270bb7134f315163fe227ae137f8f6737ce8f74defd1b069445897bc1f9bf4b11109bca1c73349ddded847a1

Download Submit
/data/user/0/legal.advice.rigid/app_DynamicOptDex/FJTIZ.json
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/legal.advice.rigid/app_DynamicOptDex/FJTIZ.json
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/legal.advice.rigid/app_DynamicOptDex/oat/FJTIZ.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/legal.advice.rigid/shared_prefs/pref_name_setting.xml
MD5
7c8fa82902cbb7036226d24d057d01da

SHA1
cc877e1552bac5030ab39a1a2181d29d16a25e8c

SHA256
165973f01a019801f611ac01266629ce4493978db218fc8ce453ee3a4c408a71

SHA512
b507bac73a599cc8799214a9c2f8432ef04c83637cb529d72cfdf002db9d6ad8c6811f6b4617f05f69f9906e3faafac6d3d6415a8426ce608064341184a2228c

Download Submit
/data/user/0/legal.advice.rigid/shared_prefs/pref_name_setting.xml
MD5
3c199cff7e727002c04cd45c0e6b847e

SHA1
4ed73f1ab49b3e0cc5c7b643e8677278bbce3a29

SHA256
646310da36ffe852495db6c1139665d4e84e4022710491cd9a314a4f6d81c0ed

SHA512
732608c818dc77fb0025e4a91247519221a4d397fd1299ba6547e0ef9a5fa3e59a9ef0a167e81b6e759fe32768f578ea2cb5841722b32963e5d01e27e0c7d31c

Download Submit
/data/user/0/legal.advice.rigid/shared_prefs/prefs30.xml
MD5
12d6ab1d27552f5788e1667ec0eb1360

SHA1
f0c1a775a55b7bb45fe65579b526cf4360c0c4d6

SHA256
52e178aa40fd1c71b3a4e8fdfb73fba744ac754430d94697f4d2aaa6823c0d18

SHA512
87eb0dba3f5fbb8801a5b8a07849c8634698d64333f77d548f4596221d2f3d7cba7288ebb0fe0b7f9357add2636b07c6e9cd24aa887dd6cce6d22a1b7e2d3d32

Download Submit

Analysis

Sharing