hydra | dcac5cfc6b96bcd708a205ab66c7ed16bbb34d52ab8f2c151233f29dafd3ad81 | Triage

Analysis

max time kernel
1353272s
max time network
127s
platform
android_x64
resource
android-x64-arm64
submitted
16/08/2021, 20:28

Sharing

Report Analysis Logs

General

Target

2e8709b59cd38e0359d32abeb11fc02fa051ba4791ddf1f6aa4f0eaf43f1cd7c.apk
Size

5.2MB
MD5

52fa05f3b1777f7c1f46d65ba36a7fad
SHA1

1aa2ec7ab1c0ba90c96bd1e7f45f10c63bf430f6
SHA256

2e8709b59cd38e0359d32abeb11fc02fa051ba4791ddf1f6aa4f0eaf43f1cd7c
SHA512

45503363517038ff07270e77af1e79a7b2f780722a09bbd6483e6ec2d04beddd02e000960c7061c4a0d74e42a77fe115c494e05598a3734aca43f1eefed1c207

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Extracted

Family

hydra

C2

https://hw2sss.xyz

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4153-0.dex	family_hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/tissue.drum.differ/app_DynamicOptDex/QOEoOs.json	4153	tissue.drum.differ
/data/user/0/tissue.drum.differ/app_DynamicOptDex/QOEoOs.json	4153	tissue.drum.differ

Uses reflection 3 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4153	tissue.drum.differ
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	4153	tissue.drum.differ
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	4153	tissue.drum.differ

tissue.drum.differ
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:4153

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads