Analysis

  • max time kernel
    533662s
  • max time network
    82s
  • platform
    android_x64
  • resource
    android-x64-arm64
  • submitted
    07-08-2021 08:49

General

  • Target

    36509_Video_Oynatıcı.apk

  • Size

    3.1MB

  • MD5

    5f9eff5c3af6f72e93937ba09f40b5d7

  • SHA1

    bdc23081a728a2557ceedcabf787e9847e6df159

  • SHA256

    ccebc2265cae07b7798d8bd7b194ae999f1e9f4b2652d3d220b873c23610f0c7

  • SHA512

    8d54d2d0297c617e0cab94b1feae1fc4e54250fd9fc66e8d5645a8a63cc000b5837dc0c6632559498bf054bc065bb3fa159027172f3711c4942c6e9a70916692

Malware Config

Extracted

Family

hydra

C2

http://courteneyguerrero584.xyz

Signatures

  • Hydra

    Android banker and info stealer.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses reflection 3 IoCs

Processes

  • com.jrrnwddn.bsjpjlt
    1⤵
    • Loads dropped Dex/Jar
    • Uses reflection
    PID:4316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.jrrnwddn.bsjpjlt/code_cache/secondary-dexes/MultiDex.lock

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.jrrnwddn.bsjpjlt/code_cache/secondary-dexes/base.apk.classes1.zip

    MD5

    c8cead98bd56feb8919c2750f502d468

    SHA1

    c0f8465438d314c526c2d3e1942ec61853757f1e

    SHA256

    d375d394a8ebc0409a5ed6fa121a0665b9c58c834959377aff2376e6b991f2e0

    SHA512

    4154459041e4d5fabbee7ac5c620f87a5bd1b59ab84da28da628ae111d8055b8d1a7eb9e67496338d143232a70482fc3b4e566a373eeabcb0517d172e97bdb4b

  • /data/user/0/com.jrrnwddn.bsjpjlt/code_cache/secondary-dexes/tmp-base.apk.classes204422766595908493.zip

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.jrrnwddn.bsjpjlt/shared_prefs/multidex.version.xml

    MD5

    520dadc8e573f868fa7f65adb48da229

    SHA1

    9a1bf273af8311c71a10367e8348ab44c69a63e1

    SHA256

    9bfe33d815ba44b58631327df14ff6b12a2c8bde480644881f2f6c1d582dfc4d

    SHA512

    2235cbe4382c147ee5853b32175d3eabb51df633eed18ff6256898f1bf3954592d375545af2c06a34ffe9bfb03e5d0e6e0eb81364ad86fc8052c587b48ad735c

  • /data/user/0/com.jrrnwddn.bsjpjlt/shared_prefs/pref_name_setting.xml

    MD5

    65661ea8b5a3359d1b5b3acfcdde8ac2

    SHA1

    42e4b87def1beb0d6e0df5e0654f520772eaf845

    SHA256

    a6e06c856dee3dd45a3b2b372e6bd6a3f05f389cdd175aa2ab9470ac8c78ff67

    SHA512

    d568aa4b46c25ca158313dd51e40fbe53f4d80c8e661e521ba176fd8b250d4f9b07c93d4ccacc3951155a0afefc7c4be689080342cf45880e19603b55140d518

  • /data/user/0/com.jrrnwddn.bsjpjlt/shared_prefs/pref_name_setting.xml

    MD5

    5b3424c4da68158980265365ee700a54

    SHA1

    400a39f87e665141beae00de9a9dc220f87ec3b8

    SHA256

    7cf3877a0eb56abd220a8ea43c9b8b3b33f7e5dfd6422dbf1c78e48233b5f287

    SHA512

    562dcbd9075b91eb7a10b1bcbbc1eaf27f3dc1065d5a9c400ed78752e6ac9b8e1b2b078ebd903c008d68eaf76e223c7c849e1b6287ffe4998ac6f47f248d61c4

  • /data/user/0/com.jrrnwddn.bsjpjlt/shared_prefs/prefs30.xml

    MD5

    1c6b6a6a91f2ccf7ac553f9a439ad69e

    SHA1

    270b45bc1c3255f95fecf8bfa85f7dbfc8fb5748

    SHA256

    a7958ee3107cac53056bac67328f317cf9e3aaf4533e1072f0c4f0334ebbffa6

    SHA512

    8a61fcab1bc82977f72af693d4a749ad41df81a9a9c6eaafee0f4ffd36a34f069a259c6b20046a8bce58a6eab526df122cb82e8d093be73cf5ff9d41e489bf8e