hydra | 1c6ff4c48a7506facfcc0f82164eeac056318c263b6ed61ae02019871cbd928c | Triage

Analysis

max time kernel
1172142s
max time network
160s
platform
android_x64
resource
android-x64
submitted
01-03-2022 14:21

Sharing

Report Analysis Logs

General

Target

bawag.apk
Size

5.2MB
MD5

423566623868a27aaba992afdde2ffe5
SHA1

99a515661d24ef2fec8406c31bd91d36602ed7cb
SHA256

1c6ff4c48a7506facfcc0f82164eeac056318c263b6ed61ae02019871cbd928c
SHA512

d6a42c4ee01cefd5c6d46fba05942895d3d1e59c9dfe3556ede2bc9506eeff07a449c2289dfd4aee19936e2435acb604422b96f6afc4410230e1edce1fbfb5af

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Checks Qemu related system properties. 1 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

description	ioc	Process
Accessed system property	key: qemu.gles	com.lioeogpo.adwfgum

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.lioeogpo.adwfgum/fIIgqfgtgy/tf8itkyfgoeukgG/base.apk.agyIugg1.aqy	3815	com.lioeogpo.adwfgum

Reads information about phone network operator.

com.lioeogpo.adwfgum
1⤵
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
PID:3815
- com.lioeogpo.adwfgum
  2⤵
  PID:3890
- toolbox
  2⤵
  PID:3890
- com.lioeogpo.adwfgum
  2⤵
  PID:3911
- /system/bin/sh
  2⤵
  PID:3911

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads