hydra | 734605a1f30870dd8fb211c8afd53afa71b3fcb138094f589098d799e589e99b

Resubmissions

31-08-2022 14:33

220831-rw9eyafegp 10

28-07-2022 07:03

220728-hvqrrsdgbl 10

25-07-2022 22:23

220725-2awxtsbdam 10

Analysis

max time kernel
1134771s
max time network
306s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
28-07-2022 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Google_chrome.apk
Size

2.5MB
MD5

2cd5f2c9f3bf4b0070479446a6c38597
SHA1

f3efb1aa48d6c6e5c75d977c3b2712ee862505cb
SHA256

734605a1f30870dd8fb211c8afd53afa71b3fcb138094f589098d799e589e99b
SHA512

75a958e097472b88d124c1ce98cbdc3255bca13ddbb1784def9d98ab2fab965e3281777378af08b17f13e64c887a5496832c7cbc95cfd47ce0af382e90a186c6

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

https://notpro.top

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4584-0.dex	family_hydra
behavioral1/memory/4281-0.dex	family_hydra

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.spring.birth
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.spring.birth
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.spring.birth

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.spring.birth/app_DynamicOptDex/eqs.json	4584	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.spring.birth/app_DynamicOptDex/eqs.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.spring.birth/app_DynamicOptDex/oat/x86/eqs.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.spring.birth/app_DynamicOptDex/eqs.json	4281	com.spring.birth

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
46	ip-api.com

Reads information about phone network operator.

com.spring.birth
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4281
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.spring.birth/app_DynamicOptDex/eqs.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.spring.birth/app_DynamicOptDex/oat/x86/eqs.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.spring.birth/app_DynamicOptDex/eqs.json

Filesize
1.3MB

MD5
0ed0faa66716f9a81c675b68f8398f1e

SHA1
3528062265d1fe1e9c443f5264b45e763d476399

SHA256
593ec8376adf97487a6f8115b1bb0b47e0891a1020265da569457fb275f89a14

SHA512
bda56c78c7386773392cc60d0efc69550d4e262b7f615f4e13226beaaac56d23c0c9fda88b68b870a4b4c0b7420101102f04ce59fb6c8144555b118d15a02e33

Download Submit
/data/user/0/com.spring.birth/app_DynamicOptDex/eqs.json

Filesize
3.6MB

MD5
75a81aeb035862880d3893f887505a5e

SHA1
bda8f4e3ed057e11e67732078555641ef32a0508

SHA256
615cdca43e38c010b7a3b8cf805fe5d03c3958713ab5f81754fde85738796b1b

SHA512
5361c0188ce903af0e142f336b903b7edb4da897fa91f3be454e06780af371a556653572f431219bd7feb11f11a5e760a24b2fc2ed9ee114de88131b03c9399b

Download Submit
/data/user/0/com.spring.birth/app_DynamicOptDex/eqs.json

Filesize
3.6MB

MD5
9a6058c280f8625e6fbcdaa29e3bd2c0

SHA1
44c031dba6a194cccf12f3c3fdd7fafd0eddd656

SHA256
12e8a559756893eda5fb2b6eb4ea7080acf1469738edad6ab9c82bda80fa456d

SHA512
ce0fc5383e3f1ef740ad06598e8c6dccd99bc80f3a44d9bba0b0f5dac9aae4ebf84c269eb26bb0538da1535e8614cdfe8e515d8f4b5ca793fc3bc5689dd7ed9d

Download Submit
/data/user/0/com.spring.birth/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit