hydra | 0b7938b3d1c0163085aac6ab5434230e5a6473ef50fb550ce0fdaee35361fe89

Analysis

max time kernel
4018417s
max time network
151s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
30-08-2022 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7483f5cc6b0e5630f18dba01f5a810d0.apk
Size

2.1MB
MD5

7483f5cc6b0e5630f18dba01f5a810d0
SHA1

b86ff064886ebe04463bcdda11e0e3e3fce6eab6
SHA256

0b7938b3d1c0163085aac6ab5434230e5a6473ef50fb550ce0fdaee35361fe89
SHA512

7d1003dc9877f4926338f197927140824da3d866fb28924f646a5ab0538e69014c29981c7c51e2a9ae4c5cd61e5d9f162a20c2b7bdbb3967f837ab8fd0f7e682
SSDEEP

49152:utTmFjrcfkEqAoXLWQXvblPYHLKojWX2GlXysS4cKdL:GT4cMEmXL3l8jyX1XS4c+

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

https://notpro.top

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4088-0.dex	family_hydra
behavioral1/memory/4028-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.uphold.hamster
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.uphold.hamster

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json	4088	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.uphold.hamster/app_DynamicOptDex/oat/x86/MNhmSI.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json	4028	com.uphold.hamster

Reads information about phone network operator.

com.uphold.hamster
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4028
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.uphold.hamster/app_DynamicOptDex/oat/x86/MNhmSI.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json

Filesize
1.3MB

MD5
00b0fa126fec6e15db462e76057c7f13

SHA1
37f3d09d495a91dbf8a8b0f78de9d2fa1ebf0160

SHA256
8f0d3575a210a038d109da7297b6df0a244c3d6fd0613303284e378da56c6e05

SHA512
3d488ee21f27c44e62691842b0a263011421ae921687dadc62e2c1e2b9c81ed975dbbc088dc3bbd807dc1c14ff4b522ef7339fbad2463560cf09f6dc6e90f3ac

Download Submit
/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json

Filesize
3.6MB

MD5
81e4adf44579ca833e70b31926cba85f

SHA1
c8ae412d2cae0318f678f846f5f9feb09de8b85f

SHA256
54311b1e2b8fcce39070d7c6e43ddebd65d810b74a37abc8af1981bee7388f55

SHA512
c26bca1e69254a4dac9beb42bf46975e67789955a16f3cc6e24593e9081a65662c2ab7034d72926da32c32b0a1bb6e9e6fe2232a762a9bf79fa72af27882d45c

Download Submit
/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json

Filesize
3.6MB

MD5
f7181404aa1af4f5aaa3d57648e5a809

SHA1
c8ce53e206e537b15305ac52fce5944ff1a71cbe

SHA256
ad1cc9998b25522914845a077d92f50b2f526291ee427db3b4a7b8ee97a25952

SHA512
d03c430dbdd33bcaec30b45078a632923070dcdf34634c8f33ececfc32844b0c83b8c28b022ac60c3a961107984bcb6651d9ce0c23171707e4d893843596dfc3

Download Submit
/data/user/0/com.uphold.hamster/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit
/data/user/0/com.uphold.hamster/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
24448d72ff659e82af4df8d3a2656a2a

SHA1
8176a2db5e4fec359ebbdc0304059139e9739d43

SHA256
4cb331540aa1e4d510c0a2a193e7e5119c45601744023e7da77a6ce8ce122f66

SHA512
d76c9ed490be41f8a5d6e872deb75593a433a4ee87915044ca3bcf9884b94459a0c1e14fa1aa2ef6951ca0dfb6c2349e5b9681a656e4b4659699f2266314f841

Download Submit