Overview

overview

10

Static

static

7

Google_chrome.apk

android-10-x64

10

Google_chrome.apk

android-11-x64

10

Resubmissions

31-08-2022 14:33

220831-rw9eyafegp 10

28-07-2022 07:03

220728-hvqrrsdgbl 10

25-07-2022 22:23

220725-2awxtsbdam 10

Analysis

  • max time kernel
    4099127s
  • max time network
    63s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    31-08-2022 14:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Google_chrome.apk

  • Size

    2.5MB

  • MD5

    2cd5f2c9f3bf4b0070479446a6c38597

  • SHA1

    f3efb1aa48d6c6e5c75d977c3b2712ee862505cb

  • SHA256

    734605a1f30870dd8fb211c8afd53afa71b3fcb138094f589098d799e589e99b

  • SHA512

    75a958e097472b88d124c1ce98cbdc3255bca13ddbb1784def9d98ab2fab965e3281777378af08b17f13e64c887a5496832c7cbc95cfd47ce0af382e90a186c6

  • SSDEEP

    49152:JsxNWnuixVhcnaoipPckKfNFBwA3QMhmGU6Os0y2NvjxwLw9:saujndwylFBwAASlUTs0ZrW8

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

https://notpro.top

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.spring.birth
    1⤵
    • Loads dropped Dex/Jar
    PID:4923

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.spring.birth/app_DynamicOptDex/eqs.json
    Filesize

    1.3MB

    MD5

    0ed0faa66716f9a81c675b68f8398f1e

    SHA1

    3528062265d1fe1e9c443f5264b45e763d476399

    SHA256

    593ec8376adf97487a6f8115b1bb0b47e0891a1020265da569457fb275f89a14

    SHA512

    bda56c78c7386773392cc60d0efc69550d4e262b7f615f4e13226beaaac56d23c0c9fda88b68b870a4b4c0b7420101102f04ce59fb6c8144555b118d15a02e33

    Download Submit

  • /data/user/0/com.spring.birth/app_DynamicOptDex/eqs.json
    Filesize

    3.6MB

    MD5

    9a6058c280f8625e6fbcdaa29e3bd2c0

    SHA1

    44c031dba6a194cccf12f3c3fdd7fafd0eddd656

    SHA256

    12e8a559756893eda5fb2b6eb4ea7080acf1469738edad6ab9c82bda80fa456d

    SHA512

    ce0fc5383e3f1ef740ad06598e8c6dccd99bc80f3a44d9bba0b0f5dac9aae4ebf84c269eb26bb0538da1535e8614cdfe8e515d8f4b5ca793fc3bc5689dd7ed9d

    Download Submit

  • /data/user/0/com.spring.birth/app_apk/payload.apk
    Filesize

    974KB

    MD5

    3baeaa766ea7f31a9147208efd957c75

    SHA1

    c701de3d0e55425394ccbf8e0967639e86f3c54e

    SHA256

    75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

    SHA512

    9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

    Download Submit

  • /data/user/0/com.spring.birth/shared_prefs/pref_name_setting.xml
    Filesize

    131B

    MD5

    d395a4eeaa7c84f2f05c8ace364000ea

    SHA1

    003b94290141e02837573b39b39426dd7ff7f8d2

    SHA256

    38a7a9d87a1da2554ca4debfc0d2b77737e300b8d6c8710047e5958d4c0036ce

    SHA512

    0a5665b49f2861ba9575359d66b252b9611a2f51511e6b605b0cacd42d6850c4c3e64bac79d1a1e83358b9aede5a332596b94f3acd3d2131216e28ecdd9cb858

    Download Submit