Analysis

  • max time kernel
    347490s
  • max time network
    37s
  • platform
    android_x64
  • resource
    android-x64
  • submitted
    05-08-2021 05:05

General

  • Target

    09586_Video_Oynatıcı.apk

  • Size

    2.6MB

  • MD5

    2a6df4abb0cfc7ab9fa51125b00c6757

  • SHA1

    2f418f5a0e63c5416708c3aa698e15e2b8671c0c

  • SHA256

    f6dbfb0b634288955450f2d779f0d17f9cfa0bf9499341909245156ccc9a1adc

  • SHA512

    c6accc51e38b2ed765d60eb439c66a48fab8be706bb04d34380154f90bf30b6bc6ed05a04566ed8e2a1557318cea5ca594fc2cc78aafc92d6621dad3cda0a1a1

Malware Config

Extracted

Family

hydra

C2

http://greysondowling458.xyz

Signatures

  • Hydra

    Android banker and info stealer.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses reflection 3 IoCs

Processes

  • com.jcojmdvo.eqdlwqn
    1⤵
    • Loads dropped Dex/Jar
    • Uses reflection
    PID:3838

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/MultiDex.lock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zip
    MD5

    588e83008876f2f285eab4828a24f317

    SHA1

    39fcff812e3940acb6a90d7e5c337dfa71b3f223

    SHA256

    91c854f41706550af73c3fe1279eb0b6a971cec172109b55f30dfe71ce451479

    SHA512

    d34317ece6dd5242002309db8bc416a40d7bdf1faba71548cbb622b68394794e6eb476bb02a33a65f6501e251e31bacec05253a96ec4152d031bffa2aab5c44a

  • /data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/tmp-base.apk.classes4400047099036418104.zip
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/multidex.version.xml
    MD5

    3ddbb84ae3874c24aa6e921453f4d5b4

    SHA1

    1f96b5ee16921827da961cec79820f3568471ae8

    SHA256

    abf7c6f9032613879ea94968efb705aead786b38f72d77f87eeb93f9d6780850

    SHA512

    b08a514bea3f014bbdd4dcc7045f37ff400907d90322f83614fbf4398fd845f8f6ef7eefb82f6ef3f1afc8bdfbaf96641bfadb58af2c2910bb6542f46141c7d2

  • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/pref_name_setting.xml
    MD5

    2f9b70dce7e4a9953825bbe30153ca85

    SHA1

    150fdbd811f13c8c67756d535b4e36a9f80711f8

    SHA256

    a8468692a43f36b7663092933df9122702354e0e6e874625deb6175abc26d825

    SHA512

    4bba19cbfd64a506ff9c1574773241a3cbb3a6893eab34667efb1885123ce80c8b3f398fe0bc30c7c1a4cbc2a35e5aaeec419b8f32c6b9ee2db2622ce546d73d

  • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/pref_name_setting.xml
    MD5

    03a5d226a9df6243b2168e43c7d1ccbe

    SHA1

    a8625a00f767b6db101e53d1d833f7175c901c73

    SHA256

    dd98d07866791074da9fd9b16a09ef751837f94d651e9b5bf93c7d0dc2053013

    SHA512

    3492a8012ed2765c7fb011fef7cb7703ecba2e9826aedfa3754d6d378728467b8d561391e4508472f92c6cf196cb2a9f11626a1f93a7293ad581b339dcc1c3b5

  • /data/user/0/com.jcojmdvo.eqdlwqn/shared_prefs/prefs30.xml
    MD5

    12d6ab1d27552f5788e1667ec0eb1360

    SHA1

    f0c1a775a55b7bb45fe65579b526cf4360c0c4d6

    SHA256

    52e178aa40fd1c71b3a4e8fdfb73fba744ac754430d94697f4d2aaa6823c0d18

    SHA512

    87eb0dba3f5fbb8801a5b8a07849c8634698d64333f77d548f4596221d2f3d7cba7288ebb0fe0b7f9357add2636b07c6e9cd24aa887dd6cce6d22a1b7e2d3d32