hydra | e3dcf86812f72b774ee51563538ad2deb75aba98c583a561046d98e2a41d47f8

General

Target

E3DCF86812F72B774EE51563538AD2DEB75ABA98C583A561046D98E2A41D47F8.apk
Size

1014KB
MD5

a32c36009a37893be90e4f385b26b5ee
SHA1

1f3f0652c0d89c4907281d76de3c983373a5fcb2
SHA256

e3dcf86812f72b774ee51563538ad2deb75aba98c583a561046d98e2a41d47f8
SHA512

9358f3b1d5a48f8d438ca25f4dd8cb5cbc6887f7f1bd69b92d573c19d9857713c17e4a3d310b72d91d1fe419816fe1061ca8d96492d380af1b9dc0104adde7b4

Score

10^/10

Family

hydra

C2

http://franciszekforster223.top

Hydra Payload 2 IoCs

resource	yara_rule
behavioral1/memory/5377-0.dex	family_hydra
behavioral1/memory/5303-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.comfort.digital
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.comfort.digital

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.comfort.digital/app_DynamicOptDex/heH.json	5377	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.comfort.digital/app_DynamicOptDex/heH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.comfort.digital/app_DynamicOptDex/oat/x86/heH.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.comfort.digital/app_DynamicOptDex/heH.json	5303	com.comfort.digital

com.comfort.digital
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5303
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.comfort.digital/app_DynamicOptDex/heH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.comfort.digital/app_DynamicOptDex/oat/x86/heH.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5377

/data/user/0/com.comfort.digital/app_DynamicOptDex/heH.json

Filesize
239KB

MD5
3680e48f9dfe67f1447957efa0a60caf

SHA1
9acdc39a4b2bab8a436df149f9d81155f84a8cde

SHA256
1365efea791e40a50a1b91f7d868b85c84ca3d77f18113b22ac51d86c85532be

SHA512
c61aa7f28c14ab819cef8d8dd5c80a26187e5f6c5f2ad9bff0cbe255e564f48ab1077aad56422bdf09586d94e42566aececcc52987b6c0b050e6d9c3cce45da4

Download Submit
/data/user/0/com.comfort.digital/app_DynamicOptDex/heH.json

Filesize
574KB

MD5
3f49b27a60092f1da13dc6125a34c239

SHA1
2b8486d2fb32ef89f008f6ce0d6bb01581351529

SHA256
86b98d48bb0068932a7dc078e7b744587306ca1d7f20f86fb627badc7bf22f15

SHA512
4a9805fd92572f26c4f18ffde9817e6b5806d01d481eda001b07fd2441e9543ef7e99624be1f25862cb032c05c4fa2e1909ac7e8b94452456d195d76db407e00

Download Submit
/data/user/0/com.comfort.digital/app_DynamicOptDex/heH.json

Filesize
574KB

MD5
c979254964da64c9819cead2cc32e23a

SHA1
44f8fb253b10fc7e0e2cdddad7db8ab5571ad7d0

SHA256
3d232856dd39589a059cbc2c422f98dbd60335ca042e77278896d24e7d593516

SHA512
29f35c2b6ccb0449a35968ab2233108a27503f23f5b88286b922285a710108e4db7a7d133632cf1bf4f6d93c5051f4154aa19f84d5cd067f7dfc9a4b826ea9c6

Download Submit