hydra | e3d68b6bf3c6a839e79cc7141a71d59b85858dd3e65764ec151c7cd849fd8080 | Triage

Analysis

max time kernel
368101s
platform
android_x86
resource
android-x86-arm
submitted
05-08-2021 10:50

Sharing

Report Analysis Logs

General

Target

39105_Video_Oynatıcı.apk
Size

2.6MB
MD5

8ab0e4eaf8dfac431a81338824426252
SHA1

a238d35b7478b5432d5ae661caf0a87aecf9e133
SHA256

e3d68b6bf3c6a839e79cc7141a71d59b85858dd3e65764ec151c7cd849fd8080
SHA512

8b0481f6e01fa02c03b10160f2ce6e2abbb051c346048c7e99505053da2c19cc1b55fadc00820c6cf977008d6503c0b149e200ef9683a1ef6077011ca27f58e6

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.psankkqa.lfugzqt/code_cache/secondary-dexes/base.apk.classes1.zip	4759	/system/bin/dex2oat
/data/user/0/com.psankkqa.lfugzqt/code_cache/secondary-dexes/base.apk.classes1.zip	4714	com.psankkqa.lfugzqt

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.psankkqa.lfugzqt

Uses reflection 1 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4714	com.psankkqa.lfugzqt

com.psankkqa.lfugzqt
1⤵
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses reflection
PID:4714
- com.psankkqa.lfugzqt
  2⤵
  PID:4759
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:4759

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads