hydra | 75ca5adbf517aa4c5b872405043ee1eced9d64e7aec3d06107738861fbd646b2 | Triage

Analysis

max time kernel
4185171s
max time network
170s
platform
android_x64
resource
android-x64
submitted
14-02-2022 18:15

Sharing

Report Analysis Logs

General

Target

b6e855cf003ac9c1ac0995f58d6d9fd7.apk
Size

5.3MB
MD5

b6e855cf003ac9c1ac0995f58d6d9fd7
SHA1

ef819498317db4d9d84423d952e8d73b17589517
SHA256

75ca5adbf517aa4c5b872405043ee1eced9d64e7aec3d06107738861fbd646b2
SHA512

0298093112049b6520c8c873b0af54dbd25af9e19888cdfe889c383c81e404ce1cb5c5a2daff53583ba95398c60cf92593bde4315ab33d0806ee64387b4a4e7f

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Checks Qemu related system properties. 1 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

description	ioc	Process
Accessed system property	key: qemu.gles	com.mwwtqjkh.wdcvslp

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.mwwtqjkh.wdcvslp/fkFUtTgG7g/GGgGgUfajjtGUgI/base.apk.jIFjo6g1.uqk	3848	com.mwwtqjkh.wdcvslp

Reads information about phone network operator.

com.mwwtqjkh.wdcvslp
1⤵
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
PID:3848
- com.mwwtqjkh.wdcvslp
  2⤵
  PID:3927
- toolbox
  2⤵
  PID:3927
- com.mwwtqjkh.wdcvslp
  2⤵
  PID:3951
- /system/bin/sh
  2⤵
  PID:3951

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads