Analysis

  • max time kernel
    1520455s
  • max time network
    142s
  • platform
    android_x64
  • resource
    android-x64
  • submitted
    14-01-2022 22:03

General

  • Target

    video_oynat.apk

  • Size

    2.5MB

  • MD5

    8b71a768b2cf5934ddf127524391af18

  • SHA1

    398e494bb0aac07b4a2ff6e2e1818aad5aa352a1

  • SHA256

    ae01b27bae902fe1e810881fd76879b4cf947da656075aa0909761821fa71168

  • SHA512

    9ae037f0ef8520f888a99757c2dc8ddd6d407c70db33a8d49abb0fe69f4c7f594339f31ab40397c2aba444f01b5e27cd102aa42f1af64701cc1a4abb526596af

Malware Config

Extracted

Family

hydra

C2

http://woodyrobinson346.website

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra Payload 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

Processes

  • com.pitch.water
    1⤵
    • Loads dropped Dex/Jar
    PID:3810

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.pitch.water/app_DynamicOptDex/wOmXDsm.json
    MD5

    4c46c9c12e36aa1f2c910b4135c080fa

    SHA1

    36322c95f25e8ea289113d66f86a1642a4691db1

    SHA256

    9c511e41a85a2dd5976fce09b310fd2d20384b4be1971a85e8abf24ef0d2fb67

    SHA512

    e01706632bfffceeccd7711ebdfbb1a374f9db8dee8a2805c639d5c85d22d6c7e15829cf58847659414e8fd16b99c7d8549ffb1e5f20bee424d7024641633538

  • /data/user/0/com.pitch.water/app_DynamicOptDex/wOmXDsm.json
    MD5

    4c46c9c12e36aa1f2c910b4135c080fa

    SHA1

    36322c95f25e8ea289113d66f86a1642a4691db1

    SHA256

    9c511e41a85a2dd5976fce09b310fd2d20384b4be1971a85e8abf24ef0d2fb67

    SHA512

    e01706632bfffceeccd7711ebdfbb1a374f9db8dee8a2805c639d5c85d22d6c7e15829cf58847659414e8fd16b99c7d8549ffb1e5f20bee424d7024641633538