hydra | 78d97e56b62a69a14febd66d7b4e9e981a8ddf0771ffdfae8db7bd68a2ff15b6 | Triage™

Resubmissions

01/08/2021, 06:03

210801-lda7ervm9x10

01/08/2021, 06:01

210801-av1pnzgzw610

Analysis

max time kernel
5350s
platform
android_x86
resource
android-x86-arm
submitted
01/08/2021, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26453_Video_Oynatıcı.apk
Size 2.6MB
Sample210801-lda7ervm9x
SHA256 78d97e56b62a69a14febd66d7b4e9e981a8ddf0771ffdfae8db7bd68a2ff15b6
MD5 662b452b490d5c18d14acfa19d35a96e
SHA1 a66b8869b84bac5662c34359ce20d7e6006cad4e
SHA512 6377e7bd773227b2d45d29626344ac7cbac4e104a57f19e369b1a18520cfdde6660dfb53f5fbe1a8845c425c38b641bb8f9e11f40060af8e270f56767a787d5c
MD5 SHA1 SHA512

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.loducwqi.ocuxbeu/code_cache/secondary-dexes/base.apk.classes1.zip	4763	/system/bin/dex2oat
/data/user/0/com.loducwqi.ocuxbeu/code_cache/secondary-dexes/base.apk.classes1.zip	4727	com.loducwqi.ocuxbeu

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.loducwqi.ocuxbeu

Uses reflection 1 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4727	com.loducwqi.ocuxbeu

com.loducwqi.ocuxbeu
1⤵
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses reflection
PID:4727
- com.loducwqi.ocuxbeu
  2⤵
  PID:4763
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:4763

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads