Analysis

  • max time kernel
    1598953s
  • max time network
    164s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220621-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
  • submitted
    02-08-2022 16:02

General

  • Target

    8b93f879e9030312f4ab748c496092ed.apk

  • Size

    2.4MB

  • MD5

    8b93f879e9030312f4ab748c496092ed

  • SHA1

    7dfe55db40b2a39e9cb5ec10dd9515e0cf819f04

  • SHA256

    90af19b082297b94f837f617fa67d2f7e894b6efb2b5917dbf97d194dde0c00b

  • SHA512

    433e9f5559e54b0ebc35a7e826f2e2e9c2364a23d34100a6d4bb8422d331d8fd6bac180c952e956e87be46d2a2d08b8df42040c5a95510163740c32903c4720e

Malware Config

Extracted

Family

hydra

C2

https://notpro.top

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.page.physical
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:5046

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.page.physical/app_DynamicOptDex/Hjx.json

    Filesize

    1.3MB

    MD5

    c2a955b0da0851e631d7c8fc75269519

    SHA1

    170e9c16401ab8fb729661a604be95171448585c

    SHA256

    93988c866cd9462681ad37fab98210a1d66403f08b2326af0c50ea94e82b2c3a

    SHA512

    112f0ad865c04c2f05174bd3df969dba5d90e5fbbc0f9fbeda94e30defc83b4124769b6f640a0a4c77a1bbc168d4a2c0596d553728ee047280d67fefdd3f39e3

  • /data/user/0/com.page.physical/app_DynamicOptDex/Hjx.json

    Filesize

    3.6MB

    MD5

    5a75e6cc1bd7fb7dd98d3d5a0a475572

    SHA1

    cd6bdcc81f9603bd05944066507e4c8f414a16af

    SHA256

    dd482b381034e3bb265ed04f46f4a1646f02bfff11847971c035a99a3d89bea5

    SHA512

    39665eba21e2662653c139d9e1489c72cb5cbe5dbe50601d7195d68a8cfd4bf144c0060469383d7b4cdd901bbc09d3c44171d2f13d0c505261f40326919f3385

  • /data/user/0/com.page.physical/app_apk/payload.apk

    Filesize

    974KB

    MD5

    3baeaa766ea7f31a9147208efd957c75

    SHA1

    c701de3d0e55425394ccbf8e0967639e86f3c54e

    SHA256

    75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

    SHA512

    9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f