Overview

overview

10

Static

static

7

c143da.apk

android_x64

10

Analysis

  • max time kernel
    118223s
  • max time network
    127s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    27-05-2022 19:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c143da.apk

  • Size

    3.3MB

  • MD5

    961b128f14e38b1eefac212a2d369e90

  • SHA1

    b37a61a033b2e61d6c0d3dae200a3543da434b6a

  • SHA256

    c143da0e00aa8d320a85193448c86eeaf7087763f9b75621a560a9043dad4251

  • SHA512

    c1ce85a0134202dfa943b5ce4361dc17802692bc76b0a9b5d5645e51d32c5a815e2b7aff10c7eaafaddb6a35579b9b2e5be810e3bec92dc42ea7494202458419

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra Payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Reads information about phone network operator.

Processes

  • com.random.frog
    1⤵
    • Loads dropped Dex/Jar
    PID:6202

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.random.frog/app_DynamicOptDex/nAFbl.json
    Filesize

    1.9MB

    MD5

    b7c9a578072aaa190ef9e686c20010d2

    SHA1

    ecd019a060f2838c368cdc6ca0ff515bc6c02ea2

    SHA256

    f8d681667ae3886e23b036499358026476436b6a46456f4b74528774dd1d9500

    SHA512

    9bef9d6c4b1eb46fac9519853548057a2cf5762646b0cb8cb825ef4b1a69a97f9190e5d39e2c5e944890927ea014383d01376a4cfb49c2225a234d1b25480c52

    Download Submit
  • /data/user/0/com.random.frog/app_DynamicOptDex/nAFbl.json
    Filesize

    5.0MB

    MD5

    412826ee6d6fab98a5471008a2cd1118

    SHA1

    17ae43b5a9128d4df9c140833bf696c42bf04ccb

    SHA256

    26fdc35c4216c1b7a810ac2e341630cca4b5faa92561df7c42ccb6ea408a8d7f

    SHA512

    8f2c5b00a730a114384f7250d2a728283909da3849bdc6f2a222891a318db520fa414ff03135afb07bf3ef44aa5af8d5efb716f1a74cf4221a5c89321d963678

    Download Submit
  • /data/user/0/com.random.frog/app_DynamicOptDex/oat/nAFbl.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.random.frog/files/all_tor.zip
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.random.frog/files/all_tor/arm64-v8a/obfs4proxy.so
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.random.frog/files/all_tor/arm64-v8a/tor.so
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.random.frog/files/all_tor/armeabi-v7a/obfs4proxy.so
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.random.frog/files/all_tor/armeabi-v7a/tor.so
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.random.frog/files/all_tor/bridges.txt
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.random.frog/files/all_tor/geoip
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.random.frog/files/all_tor/geoip6
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.random.frog/files/all_tor/torrc
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.random.frog/files/tor_source/bridges.txt
    Filesize

    422B

    MD5

    d677c5f4f107f72272e4313a23372507

    SHA1

    41400d3e8b23e61de2f7078005c87852b7b5ed4a

    SHA256

    924b9034d71e7a7cb105c1fc9731b0ae25690db2f4fc50fb3e1e0fb3db9c2e54

    SHA512

    d36168a2eaf2167002d99500ba906bd7fb6cbdbcf14a2d257dabfdd8c271783ed95e827dcd96571813e4d67f5a78cc9e70598c7b6257af9127f110ef13d9f14a

    Download Submit
  • /data/user/0/com.random.frog/files/tor_source/geoip
    Filesize

    3.9MB

    MD5

    9893523429f07b4ddc82e4133ff6603d

    SHA1

    ff83ad73de7672c77edf8888f4b241642c7c90f7

    SHA256

    d79a14e1b685ec9cfb3e9a489b9650e4092eccc468c9eef4222765857e83d96e

    SHA512

    2346a2d1616894b350fdcc6833f33a16bc031809ce80160f35af78b05a9c867d722979cdb3725c5bcddaa54518c58d88b0320a20da5f752a03c2c4758b84126a

    Download Submit
  • /data/user/0/com.random.frog/files/tor_source/geoip6
    Filesize

    2.2MB

    MD5

    3a6750bc0ab780292491c6a2b2bdc2e8

    SHA1

    b1cdbfeb7c88f82ef3b5289cafeed1321fa4693f

    SHA256

    26e2b88c992873131ba6422d6eb8f6ced94add2f5abfdbe3dcca4cbd79861d67

    SHA512

    f7a1c555b8fdea9a132367d2c0d6396c0045bf13375a3b64b686f7ea34b8ed6868d9253ca1902fbd2538994482f363045be771596d3a2c0a6a017b03903b36c7

    Download Submit
  • /data/user/0/com.random.frog/files/tor_source/obfs4proxy.so
    Filesize

    6.7MB

    MD5

    8f75c0f064ae808474d98334419374b2

    SHA1

    2541a68db820e825e40f8955baf9148113afbc49

    SHA256

    60c73335d1aca9219ec0c355e201d46160549b47534f1074751d4f0dc0f2d506

    SHA512

    41439bf307f77343e123aedf83bed1ad2d77faaeecdd9daa2c447d1a2b8e6bb44aca861a950161a0298f7150c37480e5d22126a466025de8f10c9d083e96e58f

    Download Submit
  • /data/user/0/com.random.frog/files/tor_source/tor.so
    Filesize

    6.9MB

    MD5

    5183e07a25ec7654bbd9405b5f1a4c75

    SHA1

    25057eeb42ff82668cd49b9e1bcfc39b2229955d

    SHA256

    4119996e6e2c6a57ad245c40368732972eeaf40bc9e2c22c396d69afeb4bea15

    SHA512

    a1bbd42ff89c21025404185e28ffea01906860b41ae6bb6e5d725ef28b8131e9501da7798ff0807f300cf018132e06c176332c1aa31939676bdf0cc08a3f1194

    Download Submit
  • /data/user/0/com.random.frog/files/tor_source/torrc
    Filesize

    123B

    MD5

    882a5c7bb55ad342d352770ad1a04c90

    SHA1

    b048a9cf4926febbed82f2804207bd7576a8e8e0

    SHA256

    caa24da47c90ed4a260ee260ecd1dab3f8937688e82ae0a3705703b38da43278

    SHA512

    9f3863f873fdb5625d251d0bd1cdd52f683844ead8e458571e21af4f65c947c2da0cdb3036ca4e1d9d7ca4cccbb097aaea1e253604b99a3965d4a2c4f04f97ec

    Download Submit