hydra | 5ddd49654d77b13a19cec37ab0db53095355be864405ca7fe10536813217d189

Analysis

max time kernel
2811554s
max time network
140s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
16-08-2022 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8686312c317336f0bb7b8e8344d4c98f.apk
Size

2.4MB
MD5

8686312c317336f0bb7b8e8344d4c98f
SHA1

bd4a06863d1241aab3cf9edf5316c1501d2b2f95
SHA256

5ddd49654d77b13a19cec37ab0db53095355be864405ca7fe10536813217d189
SHA512

fa7e9bc51fbb2215c066b3a1d00d6178f5bd84e5c0ee29507753d7b52dfb1f0a91f10d668bd23c00565a5df8df3ef3d4035e78f7f891aa879955e4069e5780da

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

https://notpro.top

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4428-0.dex	family_hydra
behavioral1/memory/4084-0.dex	family_hydra

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.victory.sense
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.victory.sense
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.victory.sense

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.victory.sense/app_DynamicOptDex/Khhxr.json	4428	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.victory.sense/app_DynamicOptDex/Khhxr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.victory.sense/app_DynamicOptDex/oat/x86/Khhxr.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.victory.sense/app_DynamicOptDex/Khhxr.json	4084	com.victory.sense

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	ip-api.com

Reads information about phone network operator.

com.victory.sense
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4084
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.victory.sense/app_DynamicOptDex/Khhxr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.victory.sense/app_DynamicOptDex/oat/x86/Khhxr.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.victory.sense/app_DynamicOptDex/Khhxr.json

Filesize
1.3MB

MD5
54adcffd8070578b2d3c7b2bf7931f8e

SHA1
1ce5f64f7a54d6aaf4244dd86990a0f560753bc5

SHA256
5ecfd59da8835fb587f6d2abeda38eaecee3f7e921b23b7909a65889ec12b6ab

SHA512
da3f74fdbbbd1f7d677ae031fe4e0cfe757ec8892dba80b919098a9f8e4df13b8716c3165418d302dda96a63af17cbcc60948f61c589a9bfa10cd7a9c6a10427

Download Submit
/data/user/0/com.victory.sense/app_DynamicOptDex/Khhxr.json

Filesize
3.6MB

MD5
81da1d044c8d0f6158041b373b42d8cd

SHA1
282b8d8eba1e63d25812d6e8b99ee39b19b3444c

SHA256
ce8b4453c6b727780c94ebd80f90b264d819f9172f0d49c0e229a1a9f41f926e

SHA512
f3cd99c8824fd5f62e351bafd4fcb034d12645767bf917ba20f8858d70c75ff40fcde61b84b019a3cff829086f47aef4f2acb4c11031b6e2416100f0c901fba6

Download Submit
/data/user/0/com.victory.sense/app_DynamicOptDex/Khhxr.json

Filesize
3.6MB

MD5
bfe4abdeb63bb7ca930679be5087df29

SHA1
828f80c25ab12ca251642439f690aec0aad6ecc9

SHA256
76112405f0249e3f37b36efe9d5d20fa2b40c2fb2ba5b592e9b86d9b5dabe5f4

SHA512
3582139e763ea6a32ae05d30dc1e1dabd25d529aa38921306fe3fa0044a5a177e8480bfc43167fb17ca5c3a83c22fd74bb5bd6cdfe26aa2857aa8ef8eb0734a6

Download Submit
/data/user/0/com.victory.sense/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit