hydra | e9109889d12f015832c3155da91f13dbe08784d553e5df41687af5bed789a9dd | Triage

Resubmissions

19/08/2021, 16:05

210819-v8mddtw1z6 10

19/08/2021, 15:15

210819-mz7gzhq6gn 10

Analysis

max time kernel
1593659s
max time network
125s
platform
android_x64
resource
android-x64-arm64
submitted
19/08/2021, 15:15

Sharing

Report Analysis Logs

General

Target

86924_Video_Oynatıcı.apk
Size

3.3MB
MD5

8a06d18ad2a1e43450c4506cd397b3e5
SHA1

0161de8ceee842efb5a7396f806fcfc91a5e8e30
SHA256

e9109889d12f015832c3155da91f13dbe08784d553e5df41687af5bed789a9dd
SHA512

85c83b43634a13c8ee48df4a8261502d581dadaac06b5fd169277b00ec0ff025d90d06c75b4b3823cae1d3c5d37c7dea517120e873681d2481025f3794e7bc5d

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Extracted

Family

hydra

C2

http://jannatedge58.xyz

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.vhrbutsu.roowdte/code_cache/secondary-dexes/base.apk.classes1.zip	4231	com.vhrbutsu.roowdte

Uses reflection 3 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4231	com.vhrbutsu.roowdte
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	4231	com.vhrbutsu.roowdte
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	4231	com.vhrbutsu.roowdte

com.vhrbutsu.roowdte
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:4231

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads