Analysis

  • max time kernel
    2817836s
  • max time network
    40s
  • platform
    android_x64
  • resource
    android-x64-20220621-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220621-enlocale:en-usos:android-10-x64system
  • submitted
    16-08-2022 18:36

General

  • Target

    9c96b8f5b7599b8f447d56c5e51b3e65.apk

  • Size

    2.7MB

  • MD5

    9c96b8f5b7599b8f447d56c5e51b3e65

  • SHA1

    9ea098c58e0054c4977e164c62ef9a5218fa2e1c

  • SHA256

    c87b73a7595006407d2eb454912707fa9ca4ca700a1afbea7657f7dc5f7899c6

  • SHA512

    6ffad1c6253f3bbd95a2e51dbac021f5fc4033d505685747d5836d970616fcf96601a3c59597ea4f87100293bbc6c53e3704a7f9b28da33775edf753beb6ce96

Malware Config

Extracted

Family

hydra

C2

https://notpro.top

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.lawsuit.today
    1⤵
    • Loads dropped Dex/Jar
    PID:5016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.lawsuit.today/app_DynamicOptDex/oat/wdebM.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.lawsuit.today/app_DynamicOptDex/wdebM.json
    Filesize

    1.3MB

    MD5

    5ebe4e294ee14d00e628510874fa1e7f

    SHA1

    cb158896516628256976957a3d252bcf6f401ad9

    SHA256

    b335647aad2246da6b67f7727d97562838a032e198271e5700651c51b9bf1b7b

    SHA512

    188238c09526b1680e375be98304b36c2f6595f8366e32b4a1a712d40f94ef270208dd84a903994f4e57bb5fa33b00114eb2ff3c72c36be0d95a54affecdd13b

  • /data/user/0/com.lawsuit.today/app_DynamicOptDex/wdebM.json
    Filesize

    3.6MB

    MD5

    bfe4abdeb63bb7ca930679be5087df29

    SHA1

    828f80c25ab12ca251642439f690aec0aad6ecc9

    SHA256

    76112405f0249e3f37b36efe9d5d20fa2b40c2fb2ba5b592e9b86d9b5dabe5f4

    SHA512

    3582139e763ea6a32ae05d30dc1e1dabd25d529aa38921306fe3fa0044a5a177e8480bfc43167fb17ca5c3a83c22fd74bb5bd6cdfe26aa2857aa8ef8eb0734a6