hydra | 1c6ff4c48a7506facfcc0f82164eeac056318c263b6ed61ae02019871cbd928c | Triage

Analysis

max time kernel
1172144s
max time network
169s
platform
android_x64
resource
android-x64-arm64
submitted
01-03-2022 14:21

Sharing

Report Analysis Logs

General

Target

bawag.apk
Size

5.2MB
MD5

423566623868a27aaba992afdde2ffe5
SHA1

99a515661d24ef2fec8406c31bd91d36602ed7cb
SHA256

1c6ff4c48a7506facfcc0f82164eeac056318c263b6ed61ae02019871cbd928c
SHA512

d6a42c4ee01cefd5c6d46fba05942895d3d1e59c9dfe3556ede2bc9506eeff07a449c2289dfd4aee19936e2435acb604422b96f6afc4410230e1edce1fbfb5af

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lioeogpo.adwfgum

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.lioeogpo.adwfgum/fIIgqfgtgy/tf8itkyfgoeukgG/base.apk.agyIugg1.aqy	5546	com.lioeogpo.adwfgum

com.lioeogpo.adwfgum
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5546
- com.lioeogpo.adwfgum
  2⤵
  PID:6049
- com.lioeogpo.adwfgum
  2⤵
  PID:6389

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads