hydra | 507f55a17a03490978c09690fc2f11a900b52ff7bc4a73f8af9ea9c586b83d75 | Triage

Analysis

max time kernel
4255307s
max time network
157s
platform
android_x64
resource
android-x64-arm64
submitted
15-02-2022 13:44

Sharing

Report Analysis Logs

General

Target

bawag.apk
Size

6.2MB
MD5

4212125ef94304e3dd9659186204fc5c
SHA1

c807313be5dd0fc754ba913d1b7e6a40bd8a663f
SHA256

507f55a17a03490978c09690fc2f11a900b52ff7bc4a73f8af9ea9c586b83d75
SHA512

709c3d2975b5c1b4740bd80e4b9a8a10d97e584b9cfe75185b5d4fb2f78fa2868bafbc328a2234786226233a54826eff25f929d2dc7e27d70300c7ce50d8f21d

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.nfrwxqmj.tixwgea

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nfrwxqmj.tixwgea

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.nfrwxqmj.tixwgea

ioc pid process

/data/user/0/com.nfrwxqmj.tixwgea/Gg9Gug9G6G/ItUfyqfo8gwfg8T/base.apk.hk8iIhG1.qqj 5541 com.nfrwxqmj.tixwgea

com.nfrwxqmj.tixwgea
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5541

com.nfrwxqmj.tixwgea
2⤵
PID:6065

com.nfrwxqmj.tixwgea
2⤵
PID:6382

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.nfrwxqmj.tixwgea/Gg9Gug9G6G/ItUfyqfo8gwfg8T/base.apk.hk8iIhG1.qqj
MD5
f13eed9e4b3440502301c86fcf2d2512

SHA1
b72aa5c25142e5ddd83e7c602427fce61be9981f

SHA256
c5a9d457cf1f5aead644a6ba26dcddf830c2ecc62007e637c93ff1aa00cf93c3

SHA512
730444c8ab15906967f730f2f57c68738bf6ed714d8cee83e38f49722474e7be8923a16c34ba8d1a813d4c632a7861d6d58019b71c9f7672b2ce90841f7905a6

Download Submit