hydra | 0b7938b3d1c0163085aac6ab5434230e5a6473ef50fb550ce0fdaee35361fe89

Analysis

max time kernel
4018414s
max time network
154s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
30-08-2022 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7483f5cc6b0e5630f18dba01f5a810d0.apk
Size

2.1MB
MD5

7483f5cc6b0e5630f18dba01f5a810d0
SHA1

b86ff064886ebe04463bcdda11e0e3e3fce6eab6
SHA256

0b7938b3d1c0163085aac6ab5434230e5a6473ef50fb550ce0fdaee35361fe89
SHA512

7d1003dc9877f4926338f197927140824da3d866fb28924f646a5ab0538e69014c29981c7c51e2a9ae4c5cd61e5d9f162a20c2b7bdbb3967f837ab8fd0f7e682
SSDEEP

49152:utTmFjrcfkEqAoXLWQXvblPYHLKojWX2GlXysS4cKdL:GT4cMEmXL3l8jyX1XS4c+

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

https://notpro.top

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral2/memory/4956-0.dex	family_hydra

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json	4956	com.uphold.hamster

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ip-api.com
51	ip-api.com

Reads information about phone network operator.

com.uphold.hamster
1⤵
- Loads dropped Dex/Jar
PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json

Filesize
1.3MB

MD5
00b0fa126fec6e15db462e76057c7f13

SHA1
37f3d09d495a91dbf8a8b0f78de9d2fa1ebf0160

SHA256
8f0d3575a210a038d109da7297b6df0a244c3d6fd0613303284e378da56c6e05

SHA512
3d488ee21f27c44e62691842b0a263011421ae921687dadc62e2c1e2b9c81ed975dbbc088dc3bbd807dc1c14ff4b522ef7339fbad2463560cf09f6dc6e90f3ac

Download Submit
/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json

Filesize
3.6MB

MD5
f7181404aa1af4f5aaa3d57648e5a809

SHA1
c8ce53e206e537b15305ac52fce5944ff1a71cbe

SHA256
ad1cc9998b25522914845a077d92f50b2f526291ee427db3b4a7b8ee97a25952

SHA512
d03c430dbdd33bcaec30b45078a632923070dcdf34634c8f33ececfc32844b0c83b8c28b022ac60c3a961107984bcb6651d9ce0c23171707e4d893843596dfc3

Download Submit
/data/user/0/com.uphold.hamster/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit
/data/user/0/com.uphold.hamster/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
7644a6e283e0b2f5b5f91c6277d2c791

SHA1
d6e7a50b9af73d2d80472c321ab0af24bf7d84d1

SHA256
7bcf1539ba4b8020ac1bbda66306d0f677ba04e7c04b14bd66f590e4af1e80bd

SHA512
745f750321ca0ba694776cf19cd738021d97d5af4111def186935bdc234c6b96fb55c0cad0d6ef59d77916570dd642579127d30008917440bd969de893aacc07

Download Submit