hydra | 507f55a17a03490978c09690fc2f11a900b52ff7bc4a73f8af9ea9c586b83d75 | Triage

Analysis

max time kernel
4255292s
max time network
145s
platform
android_x86
resource
android-x86-arm
submitted
15-02-2022 13:44

Sharing

Report Analysis Logs

General

Target

bawag.apk
Size

6.2MB
MD5

4212125ef94304e3dd9659186204fc5c
SHA1

c807313be5dd0fc754ba913d1b7e6a40bd8a663f
SHA256

507f55a17a03490978c09690fc2f11a900b52ff7bc4a73f8af9ea9c586b83d75
SHA512

709c3d2975b5c1b4740bd80e4b9a8a10d97e584b9cfe75185b5d4fb2f78fa2868bafbc328a2234786226233a54826eff25f929d2dc7e27d70300c7ce50d8f21d

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.nfrwxqmj.tixwgea/Gg9Gug9G6G/ItUfyqfo8gwfg8T/base.apk.hk8iIhG1.qqj	5174	/system/bin/dex2oat
/data/user/0/com.nfrwxqmj.tixwgea/Gg9Gug9G6G/ItUfyqfo8gwfg8T/base.apk.hk8iIhG1.qqj	5085	com.nfrwxqmj.tixwgea

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
75	ip-api.com

Reads information about phone network operator.

com.nfrwxqmj.tixwgea
1⤵
- Loads dropped Dex/Jar
PID:5085
- com.nfrwxqmj.tixwgea
  2⤵
  PID:5174
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:5174
- com.nfrwxqmj.tixwgea
  2⤵
  PID:5494
- toolbox
  2⤵
  PID:5494
- com.nfrwxqmj.tixwgea
  2⤵
  PID:5674
- /system/bin/sh
  2⤵
  PID:5674
- /system/bin/ndk_translation_program_runner_binfmt_misc
  2⤵
  PID:5674
- com.nfrwxqmj.tixwgea
  2⤵
  PID:5734
- /system/bin/sh
  2⤵
  PID:5734
- /system/bin/ndk_translation_program_runner_binfmt_misc
  2⤵
  PID:5734
- - /system/bin/ndk_translation_program_runner_binfmt_misc
    3⤵
    PID:5764

/system/bin/ndk_translation_program_runner_binfmt_misc
1⤵
PID:5774

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads