hydra | a6d27ba039ac9cb0d5a6a3cffca2002feb9ecb8cfed54ce5c0a768064084d43d | Triage

Resubmissions

01-03-2022 14:32

220301-rwallsbhdq 10

Analysis

max time kernel
1172807s
max time network
158s
platform
android_x64
resource
android-x64-arm64
submitted
01-03-2022 14:32

Sharing

Report Analysis Logs

General

Target

bawag.apk
Size

6.2MB
MD5

e5445cda1bf1f82fc1fd4edb1317c41f
SHA1

8b3d7122a94bb1694e1d3e33cbbd056e4350598b
SHA256

a6d27ba039ac9cb0d5a6a3cffca2002feb9ecb8cfed54ce5c0a768064084d43d
SHA512

84dcd079ac022faf2707c2cdb48bc656320307e0d03d58748de78a7fa73bfe8c071a491bdc4401e7b8d31e60024cae43c947307ffdc64d7c54e4f185076fe0bc

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ombththz.ufqsuqx

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ombththz.ufqsuqx/tyfkjfUjju/HjIgfhjyqutIhjf/base.apk.gjGyTF81.88g	5667	com.ombththz.ufqsuqx

com.ombththz.ufqsuqx
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5667
- com.ombththz.ufqsuqx
  2⤵
  PID:6376
- com.ombththz.ufqsuqx
  2⤵
  PID:6616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads