hydra | 74f3a191e941c68bbc7bf87515a12ae547e79eba4d9ffd5c2799a9c44b77dc2d | Triage

Analysis

max time kernel
1963292s
platform
android_x86
resource
android-x86-arm
submitted
12-10-2021 14:58

Sharing

Report Analysis Logs

General

Target

83079_Video_Oynatıcı.apk
Size

8.4MB
MD5

0ad3ed18db22787964e625e4db85c296
SHA1

a1f4dd7cd8ad949e59ad8680a457d681d24df2ac
SHA256

74f3a191e941c68bbc7bf87515a12ae547e79eba4d9ffd5c2799a9c44b77dc2d
SHA512

d2937b6f4cb270c911899f135453890b235a7aa74fc41e956654e96b099c5c5c2d3eb1b4ddb6e4a8efcf80f75598c1ad0396094b76f7aaf7be9d85c172eca694

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.jntdbgno.nvwrjsh/gbkjvfgddb/jlaidyqglhpuyyt/base.apk.ytfhbgk1.pxj	5047	/system/bin/dex2oat
/data/user/0/com.jntdbgno.nvwrjsh/gbkjvfgddb/jlaidyqglhpuyyt/base.apk.ytfhbgk1.pxj	5019	com.jntdbgno.nvwrjsh

Reads name of network operator 1 IoCs

Uses Android APIs to discover system information.

description	ioc	Process
Framework API call	android.telephony.TelephonyManager.getNetworkOperatorName	com.jntdbgno.nvwrjsh

com.jntdbgno.nvwrjsh
1⤵
- Loads dropped Dex/Jar
- Reads name of network operator
PID:5019
- com.jntdbgno.nvwrjsh
  2⤵
  PID:5047
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:5047
- com.jntdbgno.nvwrjsh
  2⤵
  PID:5192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads