hydra | ae6f5521304808c1871efeb9168ad649aa4996c9c55909c6c3580f43203a40b1 | Triage

Resubmissions

23/08/2021, 13:20 UTC

210823-sasf23rl4j 10

23/08/2021, 13:15 UTC

210823-4cqyd4seh2 10

Analysis

max time kernel
1932077s
platform
android_x86
resource
android-x86-arm
submitted
23/08/2021, 13:15 UTC

Sharing

Report Analysis Logs

General

Target

49506_Video_Oynatıcı.apk
Size

3.2MB
MD5

45830da853df876cc3e46716c7da738b
SHA1

cfac92065b0d115504e008683ec792e8ddc54925
SHA256

ae6f5521304808c1871efeb9168ad649aa4996c9c55909c6c3580f43203a40b1
SHA512

818de822cfb48c302f40990407914d5408d261dbad23541b2c8a458917995cfd26768b142943bd552302157ad71d45c92707fa1107bbacc4db87c4dd50e24917

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.vlvkbtii.uprlqjs/code_cache/secondary-dexes/base.apk.classes1.zip	5002	/system/bin/dex2oat
/data/user/0/com.vlvkbtii.uprlqjs/code_cache/secondary-dexes/base.apk.classes1.zip	4969	com.vlvkbtii.uprlqjs

Uses reflection 1 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	4969	com.vlvkbtii.uprlqjs

com.vlvkbtii.uprlqjs
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:4969
- com.vlvkbtii.uprlqjs
  2⤵
  PID:5002
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:5002

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads