Analysis

  • max time kernel
    1101817s
  • max time network
    131s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    15/09/2022, 14:59

General

  • Target
    bd849070c6ac6b649282325eb066144bbac76ec2dd7e514eddc28e11ca3bd2b0.apk
  • Size 2.3MB
  • Sample220915-scyprsddc5
  • SHA256 bd849070c6ac6b649282325eb066144bbac76ec2dd7e514eddc28e11ca3bd2b0
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • hydra

C2
  • http://jioluuuieyegs.info

Signatures

  • Hydra

    Android banker and info stealer.

  • Hydra payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.else.result
    1⤵
    • Loads dropped Dex/Jar
    PID:4759

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        mygDEh.json

        • Path /data/user/0/com.else.result/app_DynamicOptDex/mygDEh.json
        • Size 1.3MB
        • SHA256 3f00bc98015824104a7e8e123ece8a87726fbe1b1c3cf3044ebc376270355b49
        • MD5 SHA1 SHA512 SSDEEP

        mygDEh.json

        • Path /data/user/0/com.else.result/app_DynamicOptDex/mygDEh.json
        • Size 3.6MB
        • SHA256 83fea678ac133b73858e5c475825803233dc94064b8bd9e490cca69fef9aadaf
        • MD5 SHA1 SHA512 SSDEEP

        pref_name_setting.xml

        • Path /data/user/0/com.else.result/shared_prefs/pref_name_setting.xml
        • Size 131B
        • SHA256 ec5dd795a765229af78f7ed8baa6a608dc42dff1a9452fdae56cc0cfb8ee472a
        • MD5 SHA1 SHA512