hydra | 1c6ff4c48a7506facfcc0f82164eeac056318c263b6ed61ae02019871cbd928c | Triage

Analysis

max time kernel
1172141s
max time network
155s
platform
android_x86
resource
android-x86-arm
submitted
01-03-2022 14:21

Sharing

Report Analysis Logs

General

Target

bawag.apk
Size

5.2MB
MD5

423566623868a27aaba992afdde2ffe5
SHA1

99a515661d24ef2fec8406c31bd91d36602ed7cb
SHA256

1c6ff4c48a7506facfcc0f82164eeac056318c263b6ed61ae02019871cbd928c
SHA512

d6a42c4ee01cefd5c6d46fba05942895d3d1e59c9dfe3556ede2bc9506eeff07a449c2289dfd4aee19936e2435acb604422b96f6afc4410230e1edce1fbfb5af

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.lioeogpo.adwfgum/fIIgqfgtgy/tf8itkyfgoeukgG/base.apk.agyIugg1.aqy	5170	/system/bin/dex2oat
/data/user/0/com.lioeogpo.adwfgum/fIIgqfgtgy/tf8itkyfgoeukgG/base.apk.agyIugg1.aqy	5109	com.lioeogpo.adwfgum

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
74	ip-api.com

Reads information about phone network operator.

com.lioeogpo.adwfgum
1⤵
- Loads dropped Dex/Jar
PID:5109
- com.lioeogpo.adwfgum
  2⤵
  PID:5170
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:5170
- com.lioeogpo.adwfgum
  2⤵
  PID:5466
- toolbox
  2⤵
  PID:5466
- com.lioeogpo.adwfgum
  2⤵
  PID:5597
- /system/bin/sh
  2⤵
  PID:5597
- /system/bin/ndk_translation_program_runner_binfmt_misc
  2⤵
  PID:5597
- com.lioeogpo.adwfgum
  2⤵
  PID:5715
- /system/bin/sh
  2⤵
  PID:5715
- /system/bin/ndk_translation_program_runner_binfmt_misc
  2⤵
  PID:5715
- - /system/bin/ndk_translation_program_runner_binfmt_misc
    3⤵
    PID:5739

/system/bin/ndk_translation_program_runner_binfmt_misc
1⤵
PID:5749

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads