hydra | 8e6271b1777abb0402a1b08bda491a17e4743d57053e312f3ff8918fb0dcfb55

Analysis

max time kernel
6837s
max time network
115s
platform
android_x64
resource
android-x64
submitted
01-08-2021 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01836_Video_Oynatıcı.apk
Size

2.6MB
MD5

5f08b7472011f988eb20f0b9619408a4
SHA1

35f6b95f50b8a4dd63a4e353b7e92deec0216f5b
SHA256

8e6271b1777abb0402a1b08bda491a17e4743d57053e312f3ff8918fb0dcfb55
SHA512

db54bce5751f89c764d6843c44d325b4cf7efdb17721ea4902a47175337acecb38c115e62e254b8cc8275d1de65a0d025212b3649629460b35d61f2d5b3a2e49

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.zhnfylbf.qdbnohw

ioc pid process

/data/user/0/com.zhnfylbf.qdbnohw/code_cache/secondary-dexes/base.apk.classes1.zip 3759 com.zhnfylbf.qdbnohw
Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.zhnfylbf.qdbnohw

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.zhnfylbf.qdbnohw

ioc	pid	process
/data/user/0/com.zhnfylbf.qdbnohw/code_cache/secondary-dexes/base.apk.classes1.zip	3759	com.zhnfylbf.qdbnohw

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.zhnfylbf.qdbnohw

Uses reflection 3 IoCs

obfuscation

Processes:

com.zhnfylbf.qdbnohw

description	pid	process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	3759	com.zhnfylbf.qdbnohw
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	3759	com.zhnfylbf.qdbnohw
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	3759	com.zhnfylbf.qdbnohw

com.zhnfylbf.qdbnohw
1⤵
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses reflection
PID:3759

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.zhnfylbf.qdbnohw/code_cache/secondary-dexes/MultiDex.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.zhnfylbf.qdbnohw/code_cache/secondary-dexes/base.apk.classes1.zip
MD5
f80ef9f4fba7d38a109d9a3d4758d018

SHA1
7ab4ce2827ee8e5c2231d3e7b35e2b49201f0c3b

SHA256
cf8c5fa88271f1daa009c5f5e16219f0c7d28247ccdb9457904dcea9b19a0cc2

SHA512
b2a891bddf2b659f67693cf080c16aff968a1c5a43b9d98be591e83778d58c614d0dd726166576c6c7f7022cd8469be210fef14b44710b530581789d85f5da37

Download Submit
/data/user/0/com.zhnfylbf.qdbnohw/code_cache/secondary-dexes/tmp-base.apk.classes575828415605355849.zip
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.zhnfylbf.qdbnohw/shared_prefs/multidex.version.xml
MD5
3f0efaeed6b387c34c7405e9b9e9c635

SHA1
56836ad6e61c42558f5ddebafc257265a0734fbf

SHA256
afc6d0606297287c850915849abcdc25ff2eb35eacdb05b7f11b7a349043b55e

SHA512
6ec6248ed4239a57670f1410819d5c0c28ffcc1b6e029c26f55ca6d7f5151f98ed93c1018ef8934ba35265e17a47f5ab716bd78af915641db6c7aa7b8d842142

Download Submit
/data/user/0/com.zhnfylbf.qdbnohw/shared_prefs/pref_name_setting.xml
MD5
4a2817f9f8fd8b7dc9761e642c5aa970

SHA1
1eff2d3e6d6189796e9b58d75fafc241b8f9f238

SHA256
20edad5c0ec544cb8956079e48564a16c0f740750a845ad89c3e097a9dbfafa3

SHA512
3aaa72c1e07168424e866a36d07111aa446be20fdc2a9a4afb837e2054c618d8810612901a706c23f254c358291e105801c8acc169c4e745db986e23abe6cfb9

Download Submit
/data/user/0/com.zhnfylbf.qdbnohw/shared_prefs/pref_name_setting.xml
MD5
9e26a44c9eafc45033417ba533fdd9a5

SHA1
28b6d04d117d8208e6af3357b49b1ce1e93266cf

SHA256
e8b40c995d398e1b8b5b4cdb6af519b242f0c36a502dc896e3a9092d2d9255a7

SHA512
00e837b02647eccabe5985002d4ef485eef2fdd23390cdea5652942b264f21d301a811a0b9d642b4a261962887d2592f91c6b9cd02c7e909402bd2ef8f262f55

Download Submit
/data/user/0/com.zhnfylbf.qdbnohw/shared_prefs/pref_name_setting.xml
MD5
b472bfc6776d12587cedfbd2fdb48058

SHA1
c57f218f72768db5ac5f0f7b4b131675fb628075

SHA256
cf479307d29db22bcd9bba51b498e8b5e0acef3fefff6b76c7cadf7e17e979e3

SHA512
764cc970f421445d5d99b9ed5a19cd5e53f160a434ac5a5c49832179bd69cc203f1df0204ff65056a794aee6692eb8e894b1284444b185a7c10a3e8ef6d1d01e

Download Submit
/data/user/0/com.zhnfylbf.qdbnohw/shared_prefs/pref_name_setting.xml
MD5
9fed0f2e0f2c19acd763e26aa8523e1c

SHA1
15bfa08a3fb7468eb0ed3dd13130c6e4d297e3b1

SHA256
71b836c7bc33c71ab18ace695805f30c06d3be939c3e0270f082f1352d03e08f

SHA512
86b4f095c81454fee52af38a0a7ee47a04dfa625e8c8267972052065c599ab15cba5c28a56693ed57d399b7639f70b12485692d6b92dd3bb683b6f99013c3fb8

Download Submit
/data/user/0/com.zhnfylbf.qdbnohw/shared_prefs/prefs30.xml
MD5
12d6ab1d27552f5788e1667ec0eb1360

SHA1
f0c1a775a55b7bb45fe65579b526cf4360c0c4d6

SHA256
52e178aa40fd1c71b3a4e8fdfb73fba744ac754430d94697f4d2aaa6823c0d18

SHA512
87eb0dba3f5fbb8801a5b8a07849c8634698d64333f77d548f4596221d2f3d7cba7288ebb0fe0b7f9357add2636b07c6e9cd24aa887dd6cce6d22a1b7e2d3d32

Download Submit