hydra | f9fff0bccb018212346fd00c76015c4afffc89f739d76330ba210c48ca662d74

General

Target

f9fff0bccb018212346fd00c76015c4afffc89f739d76330ba210c48ca662d74.apk
Size

4.0MB
MD5

e7a4a02d2c1e0c90af2ce66be570faeb
SHA1

7f9771683ac59c2efd27a5693275d46ff3b71d15
SHA256

f9fff0bccb018212346fd00c76015c4afffc89f739d76330ba210c48ca662d74
SHA512

4b1537d34d5975c3ddf283b1b426e11dd614a5c8fb41f5d1f65feb3211debeb766832378f591b71814e9453ea5b831003fc280e9c7f26f31702e6f735e1ae942

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/oat/x86/PUu.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json	5113	aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg
/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json	5149	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/oat/x86/PUu.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json	5113	aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg

Reads information about phone network operator.

aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5113

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/oat/x86/PUu.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:5149

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json
Filesize
2.5MB

MD5
16936bdf43a9ec8221308901341422cb

SHA1
2710848c13541a344ae12732d2293b78e11fe457

SHA256
b036e7394a10f2be500e305cc635fc0d9d28de40c0d7a3296dbdaf80aeb3adf4

SHA512
2f6a6e93b41f9dc948f889bb18f12a4f656977d7349f21bf63c3e91eac5ef629679f480219d82dc4fcb5f7dae37b7f498806a50f9b6de89452d4fec533554db3

Download Submit
/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json
Filesize
2.5MB

MD5
3753910db0ca34dc490b66b45d4aa4b1

SHA1
c7535bbdf9b992f506c217be3f45f0af75e5fc1c

SHA256
de5c67848300899c2fb3fee28f969871c6281cdeb4cbcb4f538066b535a2d6dc

SHA512
e32e30fd7bc2395d177ce20373e02b152665f2ea47f7b3e845b576783822217036cf91eff65983fbd4b999fc6276a1bafa54164831e33908d20017bf93631541

Download Submit
/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json
Filesize
2.5MB

MD5
56d625801a9c86aea2ed036568b495ee

SHA1
d4dce19db75054eca8de2240bde3527f6d8642e2

SHA256
0d692dfe4208fcfe98f8dce12000e1df1d45ede66316fa0b571e3f23cd5da10c

SHA512
9babe8cbc1e67fb3761d541b52c0578b643b63ed5b29aaa7b27dab72d3713bb9654dff76479fd9668308d66e48e325e379cee9fc58ca6c59806698c70b80285f

Download Submit
/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json
Filesize
2.5MB

MD5
3753910db0ca34dc490b66b45d4aa4b1

SHA1
c7535bbdf9b992f506c217be3f45f0af75e5fc1c

SHA256
de5c67848300899c2fb3fee28f969871c6281cdeb4cbcb4f538066b535a2d6dc

SHA512
e32e30fd7bc2395d177ce20373e02b152665f2ea47f7b3e845b576783822217036cf91eff65983fbd4b999fc6276a1bafa54164831e33908d20017bf93631541

Download Submit
/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/PUu.json.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/oat/PUu.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/oat/x86/PUu.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/aosfhqgkatqgri.ygogxwdje.eeyhxtouxxlrbg/app_DynamicOptDex/oat/x86/PUu.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing