hydra | 3640f09bff39e3a943195ecac50c30017890013dadc9d8528fd2220e218f9abe | Triage

Analysis

max time kernel
3793242s
platform
android_x86
resource
android-x86-arm
submitted
26-07-2021 09:12

Sharing

Report Analysis Logs

General

Target

o2-Netz.apk
Size

4.8MB
MD5

011376f46a9ce15f6871530ba02465ce
SHA1

d94107888bdfbffcabc6ccb1608f741ee220e97e
SHA256

3640f09bff39e3a943195ecac50c30017890013dadc9d8528fd2220e218f9abe
SHA512

30738bad30be433c0a6b59b28b5478bb8530f54c13ac32cbb21315d7ecef1a4e742ed76683cfb071850281bdd7dfb01117f091126528b3f3f615ed88429d6a99

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4680-0.dex	family_hydra

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	4680	possible.stay.tank
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	4744	/system/bin/dex2oat
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	4680	possible.stay.tank

Uses reflection 1 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4680	possible.stay.tank

possible.stay.tank
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:4680
- possible.stay.tank
  2⤵
  PID:4744
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads