hydra | 75ca5adbf517aa4c5b872405043ee1eced9d64e7aec3d06107738861fbd646b2 | Triage

Analysis

max time kernel
4185162s
max time network
137s
platform
android_x86
resource
android-x86-arm
submitted
14-02-2022 18:15

Sharing

Report Analysis Logs

General

Target

b6e855cf003ac9c1ac0995f58d6d9fd7.apk
Size

5.3MB
MD5

b6e855cf003ac9c1ac0995f58d6d9fd7
SHA1

ef819498317db4d9d84423d952e8d73b17589517
SHA256

75ca5adbf517aa4c5b872405043ee1eced9d64e7aec3d06107738861fbd646b2
SHA512

0298093112049b6520c8c873b0af54dbd25af9e19888cdfe889c383c81e404ce1cb5c5a2daff53583ba95398c60cf92593bde4315ab33d0806ee64387b4a4e7f

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.mwwtqjkh.wdcvslp/fkFUtTgG7g/GGgGgUfajjtGUgI/base.apk.jIFjo6g1.uqk	5057	/system/bin/dex2oat
/data/user/0/com.mwwtqjkh.wdcvslp/fkFUtTgG7g/GGgGgUfajjtGUgI/base.apk.jIFjo6g1.uqk	4981	com.mwwtqjkh.wdcvslp

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
78	ip-api.com

Reads information about phone network operator.

com.mwwtqjkh.wdcvslp
1⤵
- Loads dropped Dex/Jar
PID:4981
- com.mwwtqjkh.wdcvslp
  2⤵
  PID:5057
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:5057
- com.mwwtqjkh.wdcvslp
  2⤵
  PID:5364
- toolbox
  2⤵
  PID:5364
- com.mwwtqjkh.wdcvslp
  2⤵
  PID:5434
- /system/bin/sh
  2⤵
  PID:5434
- /system/bin/ndk_translation_program_runner_binfmt_misc
  2⤵
  PID:5434
- com.mwwtqjkh.wdcvslp
  2⤵
  PID:5477
- /system/bin/sh
  2⤵
  PID:5477
- /system/bin/ndk_translation_program_runner_binfmt_misc
  2⤵
  PID:5477
- - /system/bin/ndk_translation_program_runner_binfmt_misc
    3⤵
    PID:5507

/system/bin/ndk_translation_program_runner_binfmt_misc
1⤵
PID:5517

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads