hydra | 26845b2bcec8c8d0bf31ca021ddc631c99a10fbeeaa4ddbbc9bdc73de1bb3a2c | Triage

Analysis

max time kernel
4236787s
max time network
174s
platform
android_x64
resource
android-x64
submitted
15-02-2022 08:35

Sharing

Report Analysis Logs

General

Target

a1.apk
Size

5.5MB
MD5

99c0124bd826def2b7061ce7ff37b2e3
SHA1

0217ace39fe25d09fa3ffad7594b3ab954aba097
SHA256

26845b2bcec8c8d0bf31ca021ddc631c99a10fbeeaa4ddbbc9bdc73de1bb3a2c
SHA512

d4b81e7c67b90eec445ecb6edb994b5419f9ed11cb83b6d1ea6702f6fbd67d92f32d349ce9a47c110b3ecdf7b3f5ba5212891e3caf1a28352c73ec959cef5740

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Checks Qemu related system properties. 1 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

description	ioc	Process
Accessed system property	key: qemu.gles	com.qnnhyhxs.fnwxizy

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.qnnhyhxs.fnwxizy/6fhf89eIgG/d8h8GwywU8ei8Tu/base.apk.ifGItGe1.eqy	3845	com.qnnhyhxs.fnwxizy

Reads information about phone network operator.

com.qnnhyhxs.fnwxizy
1⤵
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
PID:3845
- com.qnnhyhxs.fnwxizy
  2⤵
  PID:3962
- toolbox
  2⤵
  PID:3962
- com.qnnhyhxs.fnwxizy
  2⤵
  PID:3982
- /system/bin/sh
  2⤵
  PID:3982

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads