Analysis

  • max time kernel
    799833s
  • max time network
    161s
  • platform
    android_x64
  • resource
    android-x64
  • submitted
    06-01-2022 13:53

General

  • Target

    60427_Video_Oynatıcı.apk

  • Size

    2.5MB

  • MD5

    bb2928ec10c83a71a4a0e17ba121eaaf

  • SHA1

    70b1c16426f64777ef4106c77bf4d26ad1e2a7a7

  • SHA256

    ce6a30acd4452bb2113ae491484c9f616ed86112d8b19e121692655f37319dac

  • SHA512

    2e166eb9ac3f77d959f7d662d3f9c09b4814fc92b936473144d02d8cb0613a56ec5d0b6fbb6c925769e0535f78cc3c22573387f0b8eabce6f0af644f614a9969

Malware Config

Extracted

Family

hydra

C2

http://viveklees437.website

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

Processes

  • com.hammer.valve
    1⤵
    • Loads dropped Dex/Jar
    PID:3811

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.hammer.valve/app_DynamicOptDex/nlUFFO.json

    MD5

    fe3aa282bff42bf0b3ee36f3a5e65f29

    SHA1

    e541d98d7015cf581338247e52e029e3c6724c94

    SHA256

    d0e86792a044a03ab8317d20c27b611f4b3df006cc92394164eef86e8ae0a8c2

    SHA512

    935d3b32a812e961cb11d82c8e965e9e5f160439c030f102d87be8e09cec984d7f04482fbdc699f211c09b970271719b5942e6d031b9fe5f8b9faadb959657aa

  • /data/user/0/com.hammer.valve/app_DynamicOptDex/nlUFFO.json

    MD5

    fe3aa282bff42bf0b3ee36f3a5e65f29

    SHA1

    e541d98d7015cf581338247e52e029e3c6724c94

    SHA256

    d0e86792a044a03ab8317d20c27b611f4b3df006cc92394164eef86e8ae0a8c2

    SHA512

    935d3b32a812e961cb11d82c8e965e9e5f160439c030f102d87be8e09cec984d7f04482fbdc699f211c09b970271719b5942e6d031b9fe5f8b9faadb959657aa