hydra | 384e6d5fbf3f461001e0556a62326f98d723b71c8013af9f7eec3acdc1e8d23f | Triage

Analysis

max time kernel
3389364s
max time network
80s
platform
android_x64
resource
android-x64
submitted
17-12-2021 20:08

Sharing

Report Analysis Logs

General

Target

e1d2d505ade5058fa403ba7c1614835c.apk
Size

7.2MB
MD5

e1d2d505ade5058fa403ba7c1614835c
SHA1

ebf6d3c9e2a53534bc16dfc4f81a19633177204b
SHA256

384e6d5fbf3f461001e0556a62326f98d723b71c8013af9f7eec3acdc1e8d23f
SHA512

1b6668a4481d7752ee9eb305967630c310dc92980d0852161516e7091cc19d09416bf5a4fc142a7f7a34ec89708852529cdedd26064733f88a4d7b06d2223526

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra Payload 2 IoCs

resource	yara_rule
behavioral1/memory/3629-0.dex	family_hydra
behavioral1/memory/3629-1.dex	family_hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.bless.ordinary/app_DynamicOptDex/RWQidH.json	3629	com.bless.ordinary
/data/user/0/com.bless.ordinary/app_DynamicOptDex/RWQidH.json	3629	com.bless.ordinary

Reads information about phone network operator.

com.bless.ordinary
1⤵
- Loads dropped Dex/Jar
PID:3629
- com.bless.ordinary
  2⤵
  PID:3774
- toolbox
  2⤵
  PID:3774
- com.bless.ordinary
  2⤵
  PID:3798
- /system/bin/sh
  2⤵
  PID:3798

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads