Analysis

  • max time kernel
    800003s
  • max time network
    161s
  • platform
    android_x64
  • resource
    android-x64-arm64
  • submitted
    06-01-2022 13:53

General

  • Target

    59126_Video_Oynatıcı.apk

  • Size

    2.5MB

  • MD5

    0bb89bd490d74428e30545a7c60e595c

  • SHA1

    3183e82c86cfcdf77404c69ad44e689329310138

  • SHA256

    49d69ac875a07acf7aa353a52d5ff75fac3e39401ab051f1f2804ecb2c336a0a

  • SHA512

    d701b39fa209cb8ae33e7b3bf3ca1636a40f2dac855bc5244b9ccb6ba4b07e10200cc2e314a06cf9a3b5db7fdd93427dbcb6a500d4d6ff4baf902ec357819059

Malware Config

Extracted

Family

hydra

C2

http://viveklees437.website

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.urge.useless
    1⤵
    • Loads dropped Dex/Jar
    PID:6259

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.urge.useless/app_DynamicOptDex/QNlf.json

    MD5

    05dfab2fdb913f14f33f262222ff5ede

    SHA1

    78419c2215ed200f8793b888febe20b7dabe04a1

    SHA256

    0a877c564cb62eb10281ceb403bb638d5ce01184b85037408f79270e664eedb1

    SHA512

    5e7aafbce77b172e4f4f757d3456da3aaf5014eb1aaf38eada17143fffa5169cdc885a4a329ddb891585e638ab7f24b5402b8b31ef43fde1dfb00cf46f55d3b1

  • /data/user/0/com.urge.useless/app_DynamicOptDex/QNlf.json

    MD5

    05dfab2fdb913f14f33f262222ff5ede

    SHA1

    78419c2215ed200f8793b888febe20b7dabe04a1

    SHA256

    0a877c564cb62eb10281ceb403bb638d5ce01184b85037408f79270e664eedb1

    SHA512

    5e7aafbce77b172e4f4f757d3456da3aaf5014eb1aaf38eada17143fffa5169cdc885a4a329ddb891585e638ab7f24b5402b8b31ef43fde1dfb00cf46f55d3b1