hydra | f6dbfb0b634288955450f2d779f0d17f9cfa0bf9499341909245156ccc9a1adc | Triage

Analysis

max time kernel
347496s
platform
android_x86
resource
android-x86-arm
submitted
05-08-2021 05:05

Sharing

Report Analysis Logs

General

Target

09586_Video_Oynatıcı.apk
Size

2.6MB
MD5

2a6df4abb0cfc7ab9fa51125b00c6757
SHA1

2f418f5a0e63c5416708c3aa698e15e2b8671c0c
SHA256

f6dbfb0b634288955450f2d779f0d17f9cfa0bf9499341909245156ccc9a1adc
SHA512

c6accc51e38b2ed765d60eb439c66a48fab8be706bb04d34380154f90bf30b6bc6ed05a04566ed8e2a1557318cea5ca594fc2cc78aafc92d6621dad3cda0a1a1

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zip	4931	/system/bin/dex2oat
/data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zip	4901	com.jcojmdvo.eqdlwqn

Uses reflection 1 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4901	com.jcojmdvo.eqdlwqn

com.jcojmdvo.eqdlwqn
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:4901
- com.jcojmdvo.eqdlwqn
  2⤵
  PID:4931
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:4931

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads