hydra | 90af19b082297b94f837f617fa67d2f7e894b6efb2b5917dbf97d194dde0c00b

Analysis

max time kernel
1598951s
max time network
152s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
02-08-2022 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b93f879e9030312f4ab748c496092ed.apk
Size

2.4MB
MD5

8b93f879e9030312f4ab748c496092ed
SHA1

7dfe55db40b2a39e9cb5ec10dd9515e0cf819f04
SHA256

90af19b082297b94f837f617fa67d2f7e894b6efb2b5917dbf97d194dde0c00b
SHA512

433e9f5559e54b0ebc35a7e826f2e2e9c2364a23d34100a6d4bb8422d331d8fd6bac180c952e956e87be46d2a2d08b8df42040c5a95510163740c32903c4720e

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

https://notpro.top

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4641-0.dex	family_hydra
behavioral1/memory/4540-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.page.physical
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.page.physical

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.page.physical/app_DynamicOptDex/Hjx.json	4641	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.page.physical/app_DynamicOptDex/Hjx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.page.physical/app_DynamicOptDex/oat/x86/Hjx.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.page.physical/app_DynamicOptDex/Hjx.json	4540	com.page.physical

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ip-api.com

Reads information about phone network operator.

com.page.physical
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4540
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.page.physical/app_DynamicOptDex/Hjx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.page.physical/app_DynamicOptDex/oat/x86/Hjx.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4641

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.page.physical/app_DynamicOptDex/Hjx.json

Filesize
1.3MB

MD5
c2a955b0da0851e631d7c8fc75269519

SHA1
170e9c16401ab8fb729661a604be95171448585c

SHA256
93988c866cd9462681ad37fab98210a1d66403f08b2326af0c50ea94e82b2c3a

SHA512
112f0ad865c04c2f05174bd3df969dba5d90e5fbbc0f9fbeda94e30defc83b4124769b6f640a0a4c77a1bbc168d4a2c0596d553728ee047280d67fefdd3f39e3

Download Submit
/data/user/0/com.page.physical/app_DynamicOptDex/Hjx.json

Filesize
3.6MB

MD5
73522a15ace6d395f852d7e65b05970d

SHA1
cd9c799b785c770e4bc87d09bb783f079bf506a3

SHA256
4d2c74a86d65a35de05823b7d7f3b3a87c0e1bb7f831a68f4a6a4fbc96f82a38

SHA512
15487a7dd63b5029e935c809214ed1460adbbabb27ec7934ecdb89ad5a84225b9c339822d267ed445dceb66ccbd9cb6ebb09f2c72f2f1744df8252d78164a12b

Download Submit
/data/user/0/com.page.physical/app_DynamicOptDex/Hjx.json

Filesize
3.6MB

MD5
5a75e6cc1bd7fb7dd98d3d5a0a475572

SHA1
cd6bdcc81f9603bd05944066507e4c8f414a16af

SHA256
dd482b381034e3bb265ed04f46f4a1646f02bfff11847971c035a99a3d89bea5

SHA512
39665eba21e2662653c139d9e1489c72cb5cbe5dbe50601d7195d68a8cfd4bf144c0060469383d7b4cdd901bbc09d3c44171d2f13d0c505261f40326919f3385

Download Submit
/data/user/0/com.page.physical/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit