Analysis

  • max time kernel
    2142694s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220621-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
  • submitted
    08-08-2022 23:05

General

  • Target

    57837f13ac963a450bd76253e3d9196c.apk

  • Size

    2.6MB

  • MD5

    57837f13ac963a450bd76253e3d9196c

  • SHA1

    300b9f20c226f682b4c558e2ac5079241de4af16

  • SHA256

    585c602a6cc1ef9d397a15cd74b16e7cf9b24852a675afb1ea5c652ac30b2a74

  • SHA512

    3a2978fcfe5167141171afe097ea775073bf0af1d43fa25db3a954d57d566fe563f243b78d5ab6264b0ee31ee6b74413d844f21ff275d70f0e82a9da57b87f93

Malware Config

Extracted

Family

hydra

C2

https://notpro.top

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.tape.lens
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tape.lens/app_DynamicOptDex/LHbULyr.json

    Filesize

    1.3MB

    MD5

    d6c02f734e5c11d2d9b7d99ce45f0614

    SHA1

    99be87728f6e40a281308f757de21009ad300999

    SHA256

    3421c58e748451de19bd040ec7ba7161e2cf86f7177947ce113c816d9611ea14

    SHA512

    66ddc997ff30eb26bbe30c6042ebcad1c06ed91c903a89ae604bcb5c2b79e03edf155cf2b4a2b3d32c972039cd9eb84b40d37f3e7aa9cc1a7e612c8571a1606f

  • /data/user/0/com.tape.lens/app_DynamicOptDex/LHbULyr.json

    Filesize

    3.6MB

    MD5

    1ac811f13e7af6ac317eeab6259db820

    SHA1

    53d33fd1dd359b3c2df4ba3cb01787bfa21c84d6

    SHA256

    ce800af9e0272632c3d109cb47b9f941d4044bab80a07db0e3b288c657346aa4

    SHA512

    7a314a8f22af2a9c1bf84555efce6404642af558d987d2103f9dfe0d36afaccac6a11f3f299d3f52424c8df06e02088bec780e48ff99565ae5d7c9f8f1c91b09

  • /data/user/0/com.tape.lens/app_apk/payload.apk

    Filesize

    974KB

    MD5

    3baeaa766ea7f31a9147208efd957c75

    SHA1

    c701de3d0e55425394ccbf8e0967639e86f3c54e

    SHA256

    75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

    SHA512

    9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f