Analysis

  • max time kernel
    712108s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64
  • submitted
    05-01-2022 13:31

General

  • Target

    20841_Video_Oynatıcı.apk

  • Size

    2.4MB

  • MD5

    b11e72c94d810958df65d8716d853bc3

  • SHA1

    606a5eaf439586fc316a3befc85431091bfa786e

  • SHA256

    9ec93f30a4d4c404687abd67f4aeb19d2f50b16c7662e41aba8f86a5407ba14d

  • SHA512

    c18853c87af0198a0d19d097e1f83e0044d32b3d676a23dd0cd132499d098a951d31777153e6c6e9f9710b3fc28e74129173fc90b6c7ab2711a34a84ff5b98c5

Malware Config

Extracted

Family

hydra

C2

http://minaherrera5347.website

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.scare.obscure
    1⤵
    • Loads dropped Dex/Jar
    PID:6222

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.scare.obscure/app_DynamicOptDex/Yy.json

    MD5

    1e11861994b5b31e4c58c224eef13532

    SHA1

    1f283ac3c312401df111388d1c295a975adc37f8

    SHA256

    75491e51cbe3aff4632b5ade80f77ce14b0ccdff422ff3c457dd5552e9693697

    SHA512

    3543ab0858bc0ab478c35c28d419866d556c1e5cc081416ed03ceb8f601bc99f65a97c6c537cb501b26fa3bd09a3e3d813f926df46a3f886616e40d8683717c0

  • /data/user/0/com.scare.obscure/app_DynamicOptDex/Yy.json

    MD5

    1e11861994b5b31e4c58c224eef13532

    SHA1

    1f283ac3c312401df111388d1c295a975adc37f8

    SHA256

    75491e51cbe3aff4632b5ade80f77ce14b0ccdff422ff3c457dd5552e9693697

    SHA512

    3543ab0858bc0ab478c35c28d419866d556c1e5cc081416ed03ceb8f601bc99f65a97c6c537cb501b26fa3bd09a3e3d813f926df46a3f886616e40d8683717c0