hydra | 91126eea4f088df8a38667eff9f0fd8b6d49a58b919e8cfd242612a44d702b40 | Triage

Analysis

max time kernel
3687161s
platform
android_x86
resource
android-x86-arm
submitted
21/12/2021, 07:52

Sharing

Report Analysis Logs

General

Target

69258_Video_Oynatıcı.apk
Size

2.3MB
MD5

3ccebdec07c15dfd81412818b05a57ec
SHA1

813ffb816b1d50475d3b5d5045d4c4c637fcb259
SHA256

91126eea4f088df8a38667eff9f0fd8b6d49a58b919e8cfd242612a44d702b40
SHA512

7d8c01f90504523d2461e04803e5a411393f12e740e81994c0d03761cf1cf4d8c65248500f522206035db38949b4b1cb58696739223a0964093dea246eab65cf

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra Payload 3 IoCs

resource	yara_rule
behavioral1/memory/4839-0.dex	family_hydra
behavioral1/memory/4887-0.dex	family_hydra
behavioral1/memory/4839-1.dex	family_hydra

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.canyon.ghost/app_DynamicOptDex/qtw.json	4839	com.canyon.ghost
/data/user/0/com.canyon.ghost/app_DynamicOptDex/qtw.json	4887	/system/bin/dex2oat
/data/user/0/com.canyon.ghost/app_DynamicOptDex/qtw.json	4839	com.canyon.ghost

Reads information about phone network operator.

com.canyon.ghost
1⤵
- Loads dropped Dex/Jar
PID:4839
- com.canyon.ghost
  2⤵
  PID:4887
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:4887

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads