Analysis

  • max time kernel
    347499s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-arm64
  • submitted
    05-08-2021 05:05

General

  • Target

    09586_Video_Oynatıcı.apk

  • Size

    2.6MB

  • MD5

    2a6df4abb0cfc7ab9fa51125b00c6757

  • SHA1

    2f418f5a0e63c5416708c3aa698e15e2b8671c0c

  • SHA256

    f6dbfb0b634288955450f2d779f0d17f9cfa0bf9499341909245156ccc9a1adc

  • SHA512

    c6accc51e38b2ed765d60eb439c66a48fab8be706bb04d34380154f90bf30b6bc6ed05a04566ed8e2a1557318cea5ca594fc2cc78aafc92d6621dad3cda0a1a1

Malware Config

Extracted

Family

hydra

C2

http://greysondowling458.xyz

Signatures

  • Hydra

    Android banker and info stealer.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses reflection 3 IoCs

Processes

  • com.jcojmdvo.eqdlwqn
    1⤵
    • Loads dropped Dex/Jar
    • Uses reflection
    PID:4372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/MultiDex.lock

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zip

    MD5

    588e83008876f2f285eab4828a24f317

    SHA1

    39fcff812e3940acb6a90d7e5c337dfa71b3f223

    SHA256

    91c854f41706550af73c3fe1279eb0b6a971cec172109b55f30dfe71ce451479

    SHA512

    d34317ece6dd5242002309db8bc416a40d7bdf1faba71548cbb622b68394794e6eb476bb02a33a65f6501e251e31bacec05253a96ec4152d031bffa2aab5c44a

  • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/tmp-base.apk.classes608697551017772285.zip

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/multidex.version.xml

    MD5

    31a7de7f72e4cd4f01f9711a73197163

    SHA1

    28be23cd944bbe3b00ed681cc29311b588411dbc

    SHA256

    07aff015c7fabd11b2bb72f4e624e41dd8160120cfd37aabcd075516fdf1843c

    SHA512

    adea7c9d37a63cc9dc3f621de3df81fc831a42b4e16f6003d65d5527f9c3fb8601dd345cd3049506c446bbea9ad6de7749bb55bed16f90c756f64e38048fa011

  • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/pref_name_setting.xml

    MD5

    e9a2f22d372f0d4d47ef5411686c605d

    SHA1

    2a7453176ab028965301dfc3bba016e020af1fd8

    SHA256

    655944a75bb4ca792fb17940f6841844e285e6eaeef8b63b1559fad1f6f653b9

    SHA512

    864f1f761ee4b652a5cc5508f1deac0b8a3f0321ecfcbba288630edef74afe6cc72d7d4f462452c8a5752b6ff4f0b2bce3ca79ed564602d7696c39d0546d2d5b

  • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/pref_name_setting.xml

    MD5

    25d5ed3ac0b125bd3264bb4fdd31824c

    SHA1

    fda5b6307639bdc9dc10cc1199da9ce30979b526

    SHA256

    207d572151cd74f4f27d29829524eb75248844e3d61bd88b44fb8ebb72ba79b4

    SHA512

    e316f42e2732bfe118f3764b9f226907765e99e63973fb6eda11f5747ff432a98fb9c74c6fa5ec947a01227dce64e89e4ff8ac6d87b4c2957bdd7cead2bb83e1

  • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/prefs30.xml

    MD5

    1c6b6a6a91f2ccf7ac553f9a439ad69e

    SHA1

    270b45bc1c3255f95fecf8bfa85f7dbfc8fb5748

    SHA256

    a7958ee3107cac53056bac67328f317cf9e3aaf4533e1072f0c4f0334ebbffa6

    SHA512

    8a61fcab1bc82977f72af693d4a749ad41df81a9a9c6eaafee0f4ffd36a34f069a259c6b20046a8bce58a6eab526df122cb82e8d093be73cf5ff9d41e489bf8e