hydra | f6dbfb0b634288955450f2d779f0d17f9cfa0bf9499341909245156ccc9a1adc | Triage

Analysis

max time kernel
347490s
max time network
37s
platform
android_x64
resource
android-x64
submitted
05-08-2021 05:05

Sharing

Report Analysis Logs

General

Target

09586_Video_Oynatıcı.apk
Size

2.6MB
MD5

2a6df4abb0cfc7ab9fa51125b00c6757
SHA1

2f418f5a0e63c5416708c3aa698e15e2b8671c0c
SHA256

f6dbfb0b634288955450f2d779f0d17f9cfa0bf9499341909245156ccc9a1adc
SHA512

c6accc51e38b2ed765d60eb439c66a48fab8be706bb04d34380154f90bf30b6bc6ed05a04566ed8e2a1557318cea5ca594fc2cc78aafc92d6621dad3cda0a1a1

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Extracted

Family

hydra

C2

http://greysondowling458.xyz

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.jcojmdvo.eqdlwqn/code_cache/secondary-dexes/base.apk.classes1.zip	3838	com.jcojmdvo.eqdlwqn

Uses reflection 3 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	3838	com.jcojmdvo.eqdlwqn
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	3838	com.jcojmdvo.eqdlwqn
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	3838	com.jcojmdvo.eqdlwqn

com.jcojmdvo.eqdlwqn
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:3838

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads