hydra | d97aab6e351401596e170f056c3833bfd709cf44a2db97739a9129910fe2ece1 | Triage

Analysis

max time kernel
805737s
max time network
123s
platform
android_x64
resource
android-x64-arm64
submitted
10/08/2021, 12:23

Sharing

Report Analysis Logs

General

Target

90635_Video_Oynatıcı.apk
Size

3.1MB
MD5

e64e9fc94ff0b95e5c0cf2b38be94502
SHA1

7c9861d9fb7b00ea43113d7a36902b2c2525a1ee
SHA256

d97aab6e351401596e170f056c3833bfd709cf44a2db97739a9129910fe2ece1
SHA512

59bafd293766ac2aa60d06fe375eb4e4855dbb4d88577b83995fe0970960dadc9bf442bcba96d2bca8f757d6035e9c90ee45f1a66f934d8b13fe710da3ead220

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Extracted

Family

hydra

C2

http://shaylaprince5.xyz

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.yzojnxnf.buzdnua/code_cache/secondary-dexes/base.apk.classes1.zip	4234	com.yzojnxnf.buzdnua

Uses reflection 3 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4234	com.yzojnxnf.buzdnua
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	4234	com.yzojnxnf.buzdnua
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	4234	com.yzojnxnf.buzdnua

com.yzojnxnf.buzdnua
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:4234

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads