hydra | 0b7938b3d1c0163085aac6ab5434230e5a6473ef50fb550ce0fdaee35361fe89

Analysis

max time kernel
4018413s
max time network
149s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
30-08-2022 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7483f5cc6b0e5630f18dba01f5a810d0.apk
Size

2.1MB
MD5

7483f5cc6b0e5630f18dba01f5a810d0
SHA1

b86ff064886ebe04463bcdda11e0e3e3fce6eab6
SHA256

0b7938b3d1c0163085aac6ab5434230e5a6473ef50fb550ce0fdaee35361fe89
SHA512

7d1003dc9877f4926338f197927140824da3d866fb28924f646a5ab0538e69014c29981c7c51e2a9ae4c5cd61e5d9f162a20c2b7bdbb3967f837ab8fd0f7e682
SSDEEP

49152:utTmFjrcfkEqAoXLWQXvblPYHLKojWX2GlXysS4cKdL:GT4cMEmXL3l8jyX1XS4c+

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

https://notpro.top

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral3/memory/4305-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.uphold.hamster
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.uphold.hamster

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json	4305	com.uphold.hamster

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.uphold.hamster

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
61	ip-api.com

Reads information about phone network operator.

com.uphold.hamster
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
PID:4305

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json

Filesize
1.3MB

MD5
00b0fa126fec6e15db462e76057c7f13

SHA1
37f3d09d495a91dbf8a8b0f78de9d2fa1ebf0160

SHA256
8f0d3575a210a038d109da7297b6df0a244c3d6fd0613303284e378da56c6e05

SHA512
3d488ee21f27c44e62691842b0a263011421ae921687dadc62e2c1e2b9c81ed975dbbc088dc3bbd807dc1c14ff4b522ef7339fbad2463560cf09f6dc6e90f3ac

Download Submit
/data/user/0/com.uphold.hamster/app_DynamicOptDex/MNhmSI.json

Filesize
3.6MB

MD5
f7181404aa1af4f5aaa3d57648e5a809

SHA1
c8ce53e206e537b15305ac52fce5944ff1a71cbe

SHA256
ad1cc9998b25522914845a077d92f50b2f526291ee427db3b4a7b8ee97a25952

SHA512
d03c430dbdd33bcaec30b45078a632923070dcdf34634c8f33ececfc32844b0c83b8c28b022ac60c3a961107984bcb6651d9ce0c23171707e4d893843596dfc3

Download Submit
/data/user/0/com.uphold.hamster/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit
/data/user/0/com.uphold.hamster/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
6ea2c4f4365b7cbd7631564f7f159517

SHA1
59a1006d07c40a28b463b10a2434102e7fbaa64a

SHA256
6fde688ab8c4c2eef4b3072024b88104d185db38b4f8a6c123aab991224ed0b2

SHA512
ec3f5fe466e2cfd432745997ad6219359bd85770cb686c6b1dff2cda9808d87c423f24ba6e2e65d0a400df46218d2c7e405bc76c5b2db9187c837690a1b84299

Download Submit