hydra | e5f43b416cb378986960c47897a2331832c764344f4e8bc952f4fa2a7a9567c1

Analysis

max time kernel
1851157s
max time network
159s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
16-06-2022 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b848eb8ada2bc104098798898e48535b.apk
Size

3.2MB
MD5

b848eb8ada2bc104098798898e48535b
SHA1

358ffd876547647237d0d3fa4f78a7c2810604de
SHA256

e5f43b416cb378986960c47897a2331832c764344f4e8bc952f4fa2a7a9567c1
SHA512

9b6ca76939ab6d640aec67a17dc17c8c24aea81cc67687923997c11a77074738fa917bfb1028f07a82b896a243f0f5db2f8af27c10b9d1ab1b9831ba54473de1

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra Payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json	family_hydra
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.flame.fit

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.flame.fit
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.flame.fit

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.flame.fit/app_DynamicOptDex/oat/x86/Lpu.odex --compiler-filter=quicken --class-loader-context=&com.flame.fit

ioc	pid	process
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json	5150	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.flame.fit/app_DynamicOptDex/oat/x86/Lpu.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json	5098	com.flame.fit

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Reads information about phone network operator.

com.flame.fit
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5098

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.flame.fit/app_DynamicOptDex/oat/x86/Lpu.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:5150

toolbox ps
2⤵
PID:5531

/system/bin/sh -c /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom --verify-config
2⤵
PID:5641

/system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.flame.fit/files/tor_source/tor.so /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom --verify-config
2⤵
PID:5641

/system/bin/sh -c /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom
2⤵
PID:5695

/system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.flame.fit/files/tor_source/tor.so /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom
2⤵
PID:5695

toolbox ps
2⤵
PID:6005

toolbox ps
2⤵
PID:6905

/system/bin/sh -c /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom --verify-config
2⤵
PID:6943

/system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.flame.fit/files/tor_source/tor.so /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom --verify-config
2⤵
PID:6943

/system/bin/sh -c /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom
2⤵
PID:7101

/system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.flame.fit/files/tor_source/tor.so /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom
2⤵
PID:7101

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.flame.fit/files/control.txt.tmp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/data/com.flame.fit/files/control.txt.tmp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json
Filesize
1.9MB

MD5
50779a69dddefbbcd5435bf2e9255bf1

SHA1
62c7cc1f00d015c86ca80c06f8a44cc31e1699a4

SHA256
54fb7c9d67b8b223ef2a2f66cbc9f4a9f751326e3aadd78d464db5587893a169

SHA512
9246150e9ac253bbd8707ab99895017f96a50d4217ae5580e8602d2546c6b993f231aadc25fa9724f17be5510b6b6d6340856b6c573d5afd751d7c0fa15d737d

Download Submit
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json
Filesize
5.0MB

MD5
a6a4a78d307be22f0dde13d16f335ab7

SHA1
ed9e4c5e906d9bbe2c2d4e8cfd20559add485a60

SHA256
5d6d5037696e669505974401c40225d8c25b62ab70d591698c704c0153c829d4

SHA512
3b9ed26803abc1ae30931c7cb39977a94769dcf5fb556ee6d2efd9cc38c55ac387126eaf13bea48e6b9d72f4d710aeef1bb1d6d6b9ca1e1b384d9008d8b46244

Download Submit
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json
Filesize
5.0MB

MD5
b42b9d7a408b0e1e52109b9695f2e6eb

SHA1
beff86894edf19b07374ec23339d633bafcc103f

SHA256
f461b5a0ac8dc0516a71c6ea2306abfd876d9324bc11adec950456255e7540f1

SHA512
7c726032d649d76a1c3a7b9e8c6ab6845bb2c3561933202a4748400d39e72f5c1f816cc2a1445a8bc15c08049eae3e171442b3880e42a09a74b3981c071f2603

Download Submit
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/app_DynamicOptDex/oat/Lpu.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/app_DynamicOptDex/oat/x86/Lpu.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/app_DynamicOptDex/oat/x86/Lpu.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/files/all_tor.zip
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/files/all_tor/arm64-v8a/obfs4proxy.so
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/files/all_tor/arm64-v8a/tor.so
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/files/all_tor/armeabi-v7a/obfs4proxy.so
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/files/all_tor/armeabi-v7a/tor.so
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/files/all_tor/bridges.txt
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/files/all_tor/geoip
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/files/all_tor/geoip6
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/files/all_tor/torrc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.flame.fit/files/tor_source/bridges.txt
Filesize
422B

MD5
d677c5f4f107f72272e4313a23372507

SHA1
41400d3e8b23e61de2f7078005c87852b7b5ed4a

SHA256
924b9034d71e7a7cb105c1fc9731b0ae25690db2f4fc50fb3e1e0fb3db9c2e54

SHA512
d36168a2eaf2167002d99500ba906bd7fb6cbdbcf14a2d257dabfdd8c271783ed95e827dcd96571813e4d67f5a78cc9e70598c7b6257af9127f110ef13d9f14a

Download Submit
/data/user/0/com.flame.fit/files/tor_source/geoip
Filesize
3.9MB

MD5
9893523429f07b4ddc82e4133ff6603d

SHA1
ff83ad73de7672c77edf8888f4b241642c7c90f7

SHA256
d79a14e1b685ec9cfb3e9a489b9650e4092eccc468c9eef4222765857e83d96e

SHA512
2346a2d1616894b350fdcc6833f33a16bc031809ce80160f35af78b05a9c867d722979cdb3725c5bcddaa54518c58d88b0320a20da5f752a03c2c4758b84126a

Download Submit
/data/user/0/com.flame.fit/files/tor_source/geoip6
Filesize
2.2MB

MD5
3a6750bc0ab780292491c6a2b2bdc2e8

SHA1
b1cdbfeb7c88f82ef3b5289cafeed1321fa4693f

SHA256
26e2b88c992873131ba6422d6eb8f6ced94add2f5abfdbe3dcca4cbd79861d67

SHA512
f7a1c555b8fdea9a132367d2c0d6396c0045bf13375a3b64b686f7ea34b8ed6868d9253ca1902fbd2538994482f363045be771596d3a2c0a6a017b03903b36c7

Download Submit
/data/user/0/com.flame.fit/files/tor_source/obfs4proxy.so
Filesize
6.7MB

MD5
8f75c0f064ae808474d98334419374b2

SHA1
2541a68db820e825e40f8955baf9148113afbc49

SHA256
60c73335d1aca9219ec0c355e201d46160549b47534f1074751d4f0dc0f2d506

SHA512
41439bf307f77343e123aedf83bed1ad2d77faaeecdd9daa2c447d1a2b8e6bb44aca861a950161a0298f7150c37480e5d22126a466025de8f10c9d083e96e58f

Download Submit
/data/user/0/com.flame.fit/files/tor_source/tor.so
Filesize
6.9MB

MD5
5183e07a25ec7654bbd9405b5f1a4c75

SHA1
25057eeb42ff82668cd49b9e1bcfc39b2229955d

SHA256
4119996e6e2c6a57ad245c40368732972eeaf40bc9e2c22c396d69afeb4bea15

SHA512
a1bbd42ff89c21025404185e28ffea01906860b41ae6bb6e5d725ef28b8131e9501da7798ff0807f300cf018132e06c176332c1aa31939676bdf0cc08a3f1194

Download Submit
/data/user/0/com.flame.fit/files/tor_source/torrc
Filesize
123B

MD5
882a5c7bb55ad342d352770ad1a04c90

SHA1
b048a9cf4926febbed82f2804207bd7576a8e8e0

SHA256
caa24da47c90ed4a260ee260ecd1dab3f8937688e82ae0a3705703b38da43278

SHA512
9f3863f873fdb5625d251d0bd1cdd52f683844ead8e458571e21af4f65c947c2da0cdb3036ca4e1d9d7ca4cccbb097aaea1e253604b99a3965d4a2c4f04f97ec

Download Submit
/data/user/0/com.flame.fit/files/tor_source/torrc.custom
Filesize
405B

MD5
a721acdd5b338c79ba620a74eff40036

SHA1
663f3e71fef5968a704ba197aed4542b85ce2b49

SHA256
3d656fe8a6d9cdeb6b7e7bbc04b1bbda84115c6c90eda9d2d4dd49063cd46791

SHA512
2ba71cc386f7edb316031d00411beb20a8fb58205a169e96395193682aa1b0e261ed4423dcf30633b33c7c9b48f452bf373fc8e444b88d8952bb4f84accfb66c

Download Submit