hydra | d6709aa4b5a1f255b36df1ae342b43a5eea637d1c5ee322bbca233030e93672e

Analysis

max time kernel
151993s
max time network
130s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
08-04-2022 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mvTX2ACA_Google_Chrome_-_aHR0cDovL2xvYWJ4d3g1emJoZmFjZ3gzbHNrd2RzcTdqZHUyNXZta2RydHBuaTJrNnVzZGVhb2N.apk
Size

3.7MB
MD5

1d864a8f11e7919cbc8d0927afa6a7fd
SHA1

67288271c7daca377faadc68322d6888fe51c0bb
SHA256

d6709aa4b5a1f255b36df1ae342b43a5eea637d1c5ee322bbca233030e93672e
SHA512

4a3e209d10cd7a5c38876ae07f10f87dcbfddcce0877e9ca589d4ca2e4606d382498a83af04d4bdc6428e2c3d91b8d7761c3c37e14c120a3b5f4af5dfe649eb3

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra Payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json	family_hydra
/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.amused.cart

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.amused.cart
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.amused.cart

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.amused.cart/app_DynamicOptDex/oat/x86/gftnD.odex --compiler-filter=quicken --class-loader-context=&com.amused.cart

ioc	pid	process
/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json	5391	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.amused.cart/app_DynamicOptDex/oat/x86/gftnD.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json	5335	com.amused.cart

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Reads information about phone network operator.

com.amused.cart
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5335

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.amused.cart/app_DynamicOptDex/oat/x86/gftnD.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:5391

toolbox ps
2⤵
PID:5834

/system/bin/sh -c /data/data/com.amused.cart/files/tor_source/tor.so DataDirectory /data/data/com.amused.cart/app_data --defaults-torrc /data/data/com.amused.cart/files/tor_source/torrc -f /data/data/com.amused.cart/files/tor_source/torrc.custom --verify-config
2⤵
PID:5900

/system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.amused.cart/files/tor_source/tor.so /data/data/com.amused.cart/files/tor_source/tor.so DataDirectory /data/data/com.amused.cart/app_data --defaults-torrc /data/data/com.amused.cart/files/tor_source/torrc -f /data/data/com.amused.cart/files/tor_source/torrc.custom --verify-config
2⤵
PID:5900

/system/bin/sh -c /data/data/com.amused.cart/files/tor_source/tor.so DataDirectory /data/data/com.amused.cart/app_data --defaults-torrc /data/data/com.amused.cart/files/tor_source/torrc -f /data/data/com.amused.cart/files/tor_source/torrc.custom
2⤵
PID:6037

/system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.amused.cart/files/tor_source/tor.so /data/data/com.amused.cart/files/tor_source/tor.so DataDirectory /data/data/com.amused.cart/app_data --defaults-torrc /data/data/com.amused.cart/files/tor_source/torrc -f /data/data/com.amused.cart/files/tor_source/torrc.custom
2⤵
PID:6037

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.amused.cart/files/control.txt.tmp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json

Filesize
1.9MB

MD5
2819c436d9f24cb073eca7a440629069

SHA1
9e0fb958fc694eee52cddf988a0fce3e0af3f9b2

SHA256
39a8bb7d181615938e6811cda6292d8dc5d94657c23c67661fe20518c0042044

SHA512
a3918f2d1be2d88303ab1a60f0e19847b5aabe35303062120d600df0b7d017c17306595aa82e4c3d777e3975e9eb0b78751712feadeb690ee42122a513b64012

Download Submit
/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json

Filesize
5.0MB

MD5
0d8a69ce59523f0bf4eb9b969c75aaca

SHA1
44a552d0b2a82405a914b59f738fb7bf93ff53c4

SHA256
8b1e83d5b081c6734cbf4054e5873d6bda94df621a962d0fe97d8ce084cade78

SHA512
c967b6fbbbc6c84d6f44b2e4ea609e8ffe4e67ccc3b7f82fe9d441892ff8bcfaf8e3f68c5d5633bf28c7d8e517734699f5d5c81800cec59c3d9c3f6f4225bb9b

Download Submit
/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json

Filesize
5.0MB

MD5
854e9bae18bb376e651ad2c0a624ab06

SHA1
5851daca98f585c4a74c56346cf1e333e53539dd

SHA256
2ec148b30c11fe04333d61e1b1381a6da153ff5f93746346dd14365c6ef66355

SHA512
84efa443f8baa267da47215e2008b1f4655d72a505e10f36d47ea36eeb82da43d313953fff6d319c1cb665079615464fd7319fa3a4c031f52600395ece522b42

Download Submit
/data/user/0/com.amused.cart/app_DynamicOptDex/gftnD.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/app_DynamicOptDex/oat/gftnD.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/app_DynamicOptDex/oat/x86/gftnD.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/app_DynamicOptDex/oat/x86/gftnD.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/files/all_tor.zip

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/files/all_tor/arm64-v8a/obfs4proxy.so

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/files/all_tor/arm64-v8a/tor.so

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/files/all_tor/armeabi-v7a/obfs4proxy.so

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/files/all_tor/armeabi-v7a/tor.so

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/files/all_tor/bridges.txt

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/files/all_tor/geoip

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/files/all_tor/geoip6

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/files/all_tor/torrc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.amused.cart/files/tor_source/bridges.txt

Filesize
422B

MD5
d677c5f4f107f72272e4313a23372507

SHA1
41400d3e8b23e61de2f7078005c87852b7b5ed4a

SHA256
924b9034d71e7a7cb105c1fc9731b0ae25690db2f4fc50fb3e1e0fb3db9c2e54

SHA512
d36168a2eaf2167002d99500ba906bd7fb6cbdbcf14a2d257dabfdd8c271783ed95e827dcd96571813e4d67f5a78cc9e70598c7b6257af9127f110ef13d9f14a

Download Submit
/data/user/0/com.amused.cart/files/tor_source/geoip

Filesize
3.9MB

MD5
9893523429f07b4ddc82e4133ff6603d

SHA1
ff83ad73de7672c77edf8888f4b241642c7c90f7

SHA256
d79a14e1b685ec9cfb3e9a489b9650e4092eccc468c9eef4222765857e83d96e

SHA512
2346a2d1616894b350fdcc6833f33a16bc031809ce80160f35af78b05a9c867d722979cdb3725c5bcddaa54518c58d88b0320a20da5f752a03c2c4758b84126a

Download Submit
/data/user/0/com.amused.cart/files/tor_source/geoip6

Filesize
2.2MB

MD5
3a6750bc0ab780292491c6a2b2bdc2e8

SHA1
b1cdbfeb7c88f82ef3b5289cafeed1321fa4693f

SHA256
26e2b88c992873131ba6422d6eb8f6ced94add2f5abfdbe3dcca4cbd79861d67

SHA512
f7a1c555b8fdea9a132367d2c0d6396c0045bf13375a3b64b686f7ea34b8ed6868d9253ca1902fbd2538994482f363045be771596d3a2c0a6a017b03903b36c7

Download Submit
/data/user/0/com.amused.cart/files/tor_source/obfs4proxy.so

Filesize
6.7MB

MD5
8f75c0f064ae808474d98334419374b2

SHA1
2541a68db820e825e40f8955baf9148113afbc49

SHA256
60c73335d1aca9219ec0c355e201d46160549b47534f1074751d4f0dc0f2d506

SHA512
41439bf307f77343e123aedf83bed1ad2d77faaeecdd9daa2c447d1a2b8e6bb44aca861a950161a0298f7150c37480e5d22126a466025de8f10c9d083e96e58f

Download Submit
/data/user/0/com.amused.cart/files/tor_source/tor.so

Filesize
6.9MB

MD5
5183e07a25ec7654bbd9405b5f1a4c75

SHA1
25057eeb42ff82668cd49b9e1bcfc39b2229955d

SHA256
4119996e6e2c6a57ad245c40368732972eeaf40bc9e2c22c396d69afeb4bea15

SHA512
a1bbd42ff89c21025404185e28ffea01906860b41ae6bb6e5d725ef28b8131e9501da7798ff0807f300cf018132e06c176332c1aa31939676bdf0cc08a3f1194

Download Submit
/data/user/0/com.amused.cart/files/tor_source/torrc

Filesize
123B

MD5
882a5c7bb55ad342d352770ad1a04c90

SHA1
b048a9cf4926febbed82f2804207bd7576a8e8e0

SHA256
caa24da47c90ed4a260ee260ecd1dab3f8937688e82ae0a3705703b38da43278

SHA512
9f3863f873fdb5625d251d0bd1cdd52f683844ead8e458571e21af4f65c947c2da0cdb3036ca4e1d9d7ca4cccbb097aaea1e253604b99a3965d4a2c4f04f97ec

Download Submit
/data/user/0/com.amused.cart/files/tor_source/torrc.custom

Filesize
407B

MD5
ddae31d59951a044fe8ffbfaa0f677f5

SHA1
2ddd817191058b8859a303ae970d07dc5e048987

SHA256
fdf4143244142a4fc4fab85358d8abd3882e05d2461522fed19648a55e4ccad3

SHA512
ee455f349b8fe81b14d56c091a7c2909a959d13eb256d22b0836ede7113ea86715210688fb95167d1786c1e4a680d31cbaf3a69c767c5fec335691f1977244ef

Download Submit