hydra | a6d27ba039ac9cb0d5a6a3cffca2002feb9ecb8cfed54ce5c0a768064084d43d | Triage™

Resubmissions

05/04/2022, 16:38

220405-t5lrcaddgk

01/03/2022, 14:32

220301-rwallsbhdq10

Analysis

max time kernel
1172807s
max time network
158s
platform
android_x64
resource
android-x64-arm64
submitted
01/03/2022, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bawag.apk
Size 6.2MB
Sample220301-rwallsbhdq
SHA256 a6d27ba039ac9cb0d5a6a3cffca2002feb9ecb8cfed54ce5c0a768064084d43d
MD5 e5445cda1bf1f82fc1fd4edb1317c41f
SHA1 8b3d7122a94bb1694e1d3e33cbbd056e4350598b
SHA512 84dcd079ac022faf2707c2cdb48bc656320307e0d03d58748de78a7fa73bfe8c071a491bdc4401e7b8d31e60024cae43c947307ffdc64d7c54e4f185076fe0bc
MD5 SHA1 SHA512

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ombththz.ufqsuqx

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ombththz.ufqsuqx/tyfkjfUjju/HjIgfhjyqutIhjf/base.apk.gjGyTF81.88g	5667	com.ombththz.ufqsuqx

com.ombththz.ufqsuqx
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5667
- com.ombththz.ufqsuqx
  2⤵
  PID:6376
- com.ombththz.ufqsuqx
  2⤵
  PID:6616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads