hydra | e5f43b416cb378986960c47897a2331832c764344f4e8bc952f4fa2a7a9567c1

Analysis

max time kernel
1851157s
max time network
159s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
16-06-2022 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b848eb8ada2bc104098798898e48535b.apk
Size

3.2MB
MD5

b848eb8ada2bc104098798898e48535b
SHA1

358ffd876547647237d0d3fa4f78a7c2810604de
SHA256

e5f43b416cb378986960c47897a2331832c764344f4e8bc952f4fa2a7a9567c1
SHA512

9b6ca76939ab6d640aec67a17dc17c8c24aea81cc67687923997c11a77074738fa917bfb1028f07a82b896a243f0f5db2f8af27c10b9d1ab1b9831ba54473de1

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra Payload 2 IoCs

resource	yara_rule
behavioral1/memory/5150-0.dex	family_hydra
behavioral1/memory/5098-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.flame.fit
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.flame.fit

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json	5150	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.flame.fit/app_DynamicOptDex/oat/x86/Lpu.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json	5098	com.flame.fit

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Reads information about phone network operator.

com.flame.fit
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5098
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.flame.fit/app_DynamicOptDex/oat/x86/Lpu.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5150
- toolbox ps
  2⤵
  PID:5531
- /system/bin/sh -c /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom --verify-config
  2⤵
  PID:5641
- /system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.flame.fit/files/tor_source/tor.so /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom --verify-config
  2⤵
  PID:5641
- /system/bin/sh -c /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom
  2⤵
  PID:5695
- /system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.flame.fit/files/tor_source/tor.so /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom
  2⤵
  PID:5695
- toolbox ps
  2⤵
  PID:6005
- toolbox ps
  2⤵
  PID:6905
- /system/bin/sh -c /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom --verify-config
  2⤵
  PID:6943
- /system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.flame.fit/files/tor_source/tor.so /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom --verify-config
  2⤵
  PID:6943
- /system/bin/sh -c /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom
  2⤵
  PID:7101
- /system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.flame.fit/files/tor_source/tor.so /data/data/com.flame.fit/files/tor_source/tor.so DataDirectory /data/data/com.flame.fit/app_data --defaults-torrc /data/data/com.flame.fit/files/tor_source/torrc -f /data/data/com.flame.fit/files/tor_source/torrc.custom
  2⤵
  PID:7101

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json

Filesize
1.9MB

MD5
50779a69dddefbbcd5435bf2e9255bf1

SHA1
62c7cc1f00d015c86ca80c06f8a44cc31e1699a4

SHA256
54fb7c9d67b8b223ef2a2f66cbc9f4a9f751326e3aadd78d464db5587893a169

SHA512
9246150e9ac253bbd8707ab99895017f96a50d4217ae5580e8602d2546c6b993f231aadc25fa9724f17be5510b6b6d6340856b6c573d5afd751d7c0fa15d737d

Download Submit
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json

Filesize
5.0MB

MD5
a6a4a78d307be22f0dde13d16f335ab7

SHA1
ed9e4c5e906d9bbe2c2d4e8cfd20559add485a60

SHA256
5d6d5037696e669505974401c40225d8c25b62ab70d591698c704c0153c829d4

SHA512
3b9ed26803abc1ae30931c7cb39977a94769dcf5fb556ee6d2efd9cc38c55ac387126eaf13bea48e6b9d72f4d710aeef1bb1d6d6b9ca1e1b384d9008d8b46244

Download Submit
/data/user/0/com.flame.fit/app_DynamicOptDex/Lpu.json

Filesize
5.0MB

MD5
b42b9d7a408b0e1e52109b9695f2e6eb

SHA1
beff86894edf19b07374ec23339d633bafcc103f

SHA256
f461b5a0ac8dc0516a71c6ea2306abfd876d9324bc11adec950456255e7540f1

SHA512
7c726032d649d76a1c3a7b9e8c6ab6845bb2c3561933202a4748400d39e72f5c1f816cc2a1445a8bc15c08049eae3e171442b3880e42a09a74b3981c071f2603

Download Submit
/data/user/0/com.flame.fit/files/tor_source/bridges.txt

Filesize
422B

MD5
d677c5f4f107f72272e4313a23372507

SHA1
41400d3e8b23e61de2f7078005c87852b7b5ed4a

SHA256
924b9034d71e7a7cb105c1fc9731b0ae25690db2f4fc50fb3e1e0fb3db9c2e54

SHA512
d36168a2eaf2167002d99500ba906bd7fb6cbdbcf14a2d257dabfdd8c271783ed95e827dcd96571813e4d67f5a78cc9e70598c7b6257af9127f110ef13d9f14a

Download Submit
/data/user/0/com.flame.fit/files/tor_source/geoip

Filesize
3.9MB

MD5
9893523429f07b4ddc82e4133ff6603d

SHA1
ff83ad73de7672c77edf8888f4b241642c7c90f7

SHA256
d79a14e1b685ec9cfb3e9a489b9650e4092eccc468c9eef4222765857e83d96e

SHA512
2346a2d1616894b350fdcc6833f33a16bc031809ce80160f35af78b05a9c867d722979cdb3725c5bcddaa54518c58d88b0320a20da5f752a03c2c4758b84126a

Download Submit
/data/user/0/com.flame.fit/files/tor_source/geoip6

Filesize
2.2MB

MD5
3a6750bc0ab780292491c6a2b2bdc2e8

SHA1
b1cdbfeb7c88f82ef3b5289cafeed1321fa4693f

SHA256
26e2b88c992873131ba6422d6eb8f6ced94add2f5abfdbe3dcca4cbd79861d67

SHA512
f7a1c555b8fdea9a132367d2c0d6396c0045bf13375a3b64b686f7ea34b8ed6868d9253ca1902fbd2538994482f363045be771596d3a2c0a6a017b03903b36c7

Download Submit
/data/user/0/com.flame.fit/files/tor_source/obfs4proxy.so

Filesize
6.7MB

MD5
8f75c0f064ae808474d98334419374b2

SHA1
2541a68db820e825e40f8955baf9148113afbc49

SHA256
60c73335d1aca9219ec0c355e201d46160549b47534f1074751d4f0dc0f2d506

SHA512
41439bf307f77343e123aedf83bed1ad2d77faaeecdd9daa2c447d1a2b8e6bb44aca861a950161a0298f7150c37480e5d22126a466025de8f10c9d083e96e58f

Download Submit
/data/user/0/com.flame.fit/files/tor_source/tor.so

Filesize
6.9MB

MD5
5183e07a25ec7654bbd9405b5f1a4c75

SHA1
25057eeb42ff82668cd49b9e1bcfc39b2229955d

SHA256
4119996e6e2c6a57ad245c40368732972eeaf40bc9e2c22c396d69afeb4bea15

SHA512
a1bbd42ff89c21025404185e28ffea01906860b41ae6bb6e5d725ef28b8131e9501da7798ff0807f300cf018132e06c176332c1aa31939676bdf0cc08a3f1194

Download Submit
/data/user/0/com.flame.fit/files/tor_source/torrc

Filesize
123B

MD5
882a5c7bb55ad342d352770ad1a04c90

SHA1
b048a9cf4926febbed82f2804207bd7576a8e8e0

SHA256
caa24da47c90ed4a260ee260ecd1dab3f8937688e82ae0a3705703b38da43278

SHA512
9f3863f873fdb5625d251d0bd1cdd52f683844ead8e458571e21af4f65c947c2da0cdb3036ca4e1d9d7ca4cccbb097aaea1e253604b99a3965d4a2c4f04f97ec

Download Submit
/data/user/0/com.flame.fit/files/tor_source/torrc.custom

Filesize
405B

MD5
a721acdd5b338c79ba620a74eff40036

SHA1
663f3e71fef5968a704ba197aed4542b85ce2b49

SHA256
3d656fe8a6d9cdeb6b7e7bbc04b1bbda84115c6c90eda9d2d4dd49063cd46791

SHA512
2ba71cc386f7edb316031d00411beb20a8fb58205a169e96395193682aa1b0e261ed4423dcf30633b33c7c9b48f452bf373fc8e444b88d8952bb4f84accfb66c

Download Submit