Overview

overview

10

Static

static

7

bawag.apk

android_x86

10

bawag.apk

android_x64

10

bawag.apk

android_x64

10

Analysis

  • max time kernel
    3757751s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220310-en
  • submitted
    31/03/2022, 12:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bawag.apk
  • Size 3.4MB
  • Sample220331-pql2cafhhm
  • SHA256 ab2e9fd467a198b293b276abc08d1a1c6a5e9679d5a89d1b45e31eb64b59238a
  • MD5 SHA1 SHA512
Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra Payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs

Processes

  • com.belt.space
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:5869

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ZZ.json
        • Path /data/user/0/com.belt.space/app_DynamicOptDex/ZZ.json
        • Size 1.9MB
        • SHA256 6e23c7bf2c0caef429ce4a83c9f6842fc29c50754aa5b238a162bb5637fdb6f7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ZZ.json
        • Path /data/user/0/com.belt.space/app_DynamicOptDex/ZZ.json
        • Size 5.0MB
        • SHA256 26fdc35c4216c1b7a810ac2e341630cca4b5faa92561df7c42ccb6ea408a8d7f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        bridges.txt
        • Path /data/user/0/com.belt.space/files/tor_source/bridges.txt
        • Size 422B
        • SHA256 924b9034d71e7a7cb105c1fc9731b0ae25690db2f4fc50fb3e1e0fb3db9c2e54
        • MD5 SHA1 SHA512
        Submit Download

        geoip
        • Path /data/user/0/com.belt.space/files/tor_source/geoip
        • Size 3.9MB
        • SHA256 d79a14e1b685ec9cfb3e9a489b9650e4092eccc468c9eef4222765857e83d96e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        geoip6
        • Path /data/user/0/com.belt.space/files/tor_source/geoip6
        • Size 2.2MB
        • SHA256 26e2b88c992873131ba6422d6eb8f6ced94add2f5abfdbe3dcca4cbd79861d67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        obfs4proxy.so
        • Path /data/user/0/com.belt.space/files/tor_source/obfs4proxy.so
        • Size 6.7MB
        • SHA256 60c73335d1aca9219ec0c355e201d46160549b47534f1074751d4f0dc0f2d506
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tor.so
        • Path /data/user/0/com.belt.space/files/tor_source/tor.so
        • Size 6.9MB
        • SHA256 4119996e6e2c6a57ad245c40368732972eeaf40bc9e2c22c396d69afeb4bea15
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        torrc
        • Path /data/user/0/com.belt.space/files/tor_source/torrc
        • Size 123B
        • SHA256 caa24da47c90ed4a260ee260ecd1dab3f8937688e82ae0a3705703b38da43278
        • MD5 SHA1 SHA512
        Submit Download