hydra | b9dd9650cb0591a0c15e44da102dc65449aca415822c102c26fb7a0321803374 | Triage™

Analysis

max time kernel
4249645s
max time network
170s
platform
android_x64
resource
android-x64
submitted
15/02/2022, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9dd9650cb0591a0c15e44da102dc65449aca415822c102c26fb7a0321803374.apk
Size 6.0MB
Sample220215-pbbl3aefa9
SHA256 b9dd9650cb0591a0c15e44da102dc65449aca415822c102c26fb7a0321803374
MD5 f9bc80b984b9ca2012dab7b557d25f25
SHA1 e13fdc7d91e9b890cfe5940a7245344a01a2179e
SHA512 5090e552ce2efb5bbae29a05b00d5ff76bf61f5484e327df686f49ac99d23955bc6d496ebe23326c218e6cccee745e970a899596f60c90c57f1a6f2e2323cd0a
MD5 SHA1 SHA512

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Checks Qemu related system properties. 1 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

description	ioc	Process
Accessed system property	key: qemu.gles	com.ibpizpaa.bdtddqo

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ibpizpaa.bdtddqo/ghfh8GUUgG/wtgyqfjGfqhpttG/base.apk.q8juGj71.wqi	3849	com.ibpizpaa.bdtddqo

Reads information about phone network operator.

com.ibpizpaa.bdtddqo
1⤵
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
PID:3849
- com.ibpizpaa.bdtddqo
  2⤵
  PID:3962
- toolbox
  2⤵
  PID:3962
- com.ibpizpaa.bdtddqo
  2⤵
  PID:3985
- /system/bin/sh
  2⤵
  PID:3985

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads