hydra | 585c602a6cc1ef9d397a15cd74b16e7cf9b24852a675afb1ea5c652ac30b2a74

Analysis

max time kernel
2142693s
max time network
152s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
08-08-2022 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57837f13ac963a450bd76253e3d9196c.apk
Size

2.6MB
MD5

57837f13ac963a450bd76253e3d9196c
SHA1

300b9f20c226f682b4c558e2ac5079241de4af16
SHA256

585c602a6cc1ef9d397a15cd74b16e7cf9b24852a675afb1ea5c652ac30b2a74
SHA512

3a2978fcfe5167141171afe097ea775073bf0af1d43fa25db3a954d57d566fe563f243b78d5ab6264b0ee31ee6b74413d844f21ff275d70f0e82a9da57b87f93

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

https://notpro.top

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4109-0.dex	family_hydra
behavioral1/memory/4047-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tape.lens
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tape.lens

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tape.lens/app_DynamicOptDex/LHbULyr.json	4109	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tape.lens/app_DynamicOptDex/LHbULyr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tape.lens/app_DynamicOptDex/oat/x86/LHbULyr.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tape.lens/app_DynamicOptDex/LHbULyr.json	4047	com.tape.lens

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	ip-api.com

Reads information about phone network operator.

com.tape.lens
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4047
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tape.lens/app_DynamicOptDex/LHbULyr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tape.lens/app_DynamicOptDex/oat/x86/LHbULyr.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4109

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tape.lens/app_DynamicOptDex/LHbULyr.json

Filesize
1.3MB

MD5
d6c02f734e5c11d2d9b7d99ce45f0614

SHA1
99be87728f6e40a281308f757de21009ad300999

SHA256
3421c58e748451de19bd040ec7ba7161e2cf86f7177947ce113c816d9611ea14

SHA512
66ddc997ff30eb26bbe30c6042ebcad1c06ed91c903a89ae604bcb5c2b79e03edf155cf2b4a2b3d32c972039cd9eb84b40d37f3e7aa9cc1a7e612c8571a1606f

Download Submit
/data/user/0/com.tape.lens/app_DynamicOptDex/LHbULyr.json

Filesize
3.6MB

MD5
1117edb18143396bbe1b53edc7b6e83a

SHA1
260678734fb993a0ace5da9b1ef81fcc52e768b1

SHA256
52bd4edf313c49f184efe2eed0d8ace0058c081b06daf670a7498c9547d71e2a

SHA512
4304f4640cc1606321484a373ef26895430054a3ea0f307ab62ff3c6841b32ce0c0f5343fb879f785380050ade6ffd31ba867068f52e9cc2c1c314927163c414

Download Submit
/data/user/0/com.tape.lens/app_DynamicOptDex/LHbULyr.json

Filesize
3.6MB

MD5
1ac811f13e7af6ac317eeab6259db820

SHA1
53d33fd1dd359b3c2df4ba3cb01787bfa21c84d6

SHA256
ce800af9e0272632c3d109cb47b9f941d4044bab80a07db0e3b288c657346aa4

SHA512
7a314a8f22af2a9c1bf84555efce6404642af558d987d2103f9dfe0d36afaccac6a11f3f299d3f52424c8df06e02088bec780e48ff99565ae5d7c9f8f1c91b09

Download Submit
/data/user/0/com.tape.lens/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit