hydra | 9cbdd422daf93e15b2135f0f6feebf7428eaaaba4aeaf18c12e882e67a849c89 | Triage

Analysis

max time kernel
193360s
platform
android_x86
resource
android-x86-arm
submitted
03-08-2021 10:16

Sharing

Report Analysis Logs

General

Target

29516_Video_Oynatıcı.apk
Size

2.6MB
MD5

723d4d2c92d5d6da8fe7c30e21a3fe01
SHA1

a898aaf26cbccc88c372c59414be88d5e3e7991a
SHA256

9cbdd422daf93e15b2135f0f6feebf7428eaaaba4aeaf18c12e882e67a849c89
SHA512

96b26e1462ba1cc02505c14ee1f54798b1f176c0a95a0564294980315038f5d2eaa02f0c558edd24fefb18dc52f20412044cecab9926b2ccba989bfc3284c895

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.nvlcdjjl.yrsbiav/code_cache/secondary-dexes/base.apk.classes1.zip	5165	/system/bin/dex2oat
/data/user/0/com.nvlcdjjl.yrsbiav/code_cache/secondary-dexes/base.apk.classes1.zip	5136	com.nvlcdjjl.yrsbiav

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.nvlcdjjl.yrsbiav

Uses reflection 1 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	5136	com.nvlcdjjl.yrsbiav

com.nvlcdjjl.yrsbiav
1⤵
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses reflection
PID:5136
- com.nvlcdjjl.yrsbiav
  2⤵
  PID:5165
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:5165

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads