Overview

overview

10

Static

static

7

18c5bf8ee1...b4.apk

android-9-x86

10

18c5bf8ee1...b4.apk

android-10-x64

10

18c5bf8ee1...b4.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18c5bf8ee185102b2cffb7e19ea9480113e94544f78c4d3eef628f635c2b77b4.apk

  • Size

    1.0MB

  • Sample

    220915-sl7n2adde6

  • MD5

    7b5ca7af7560e1e00a53e3b2da398e8d

  • SHA1

    d553b5b5fdb8e5b9c8bf291039820b4ff30ace87

  • SHA256

    18c5bf8ee185102b2cffb7e19ea9480113e94544f78c4d3eef628f635c2b77b4

  • SHA512

    1c416cc854000256adb6d2e34b401ff53d919aa503e40b9153186669521840efb67f9affe698911c6acb487ed918dc01e4aebbf32eb3e81b1bb5dd4e29237295

  • SSDEEP

    24576:a/xMjXBYdbtCk1w72Ctm/8Hf95fVkbLXZVs5A0w45:aZbnK72CcMfb9ULiA0w45

Score
10/10
hydraandroidbankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

http://laurenwarren1566.top

Targets

    • Target

      18c5bf8ee185102b2cffb7e19ea9480113e94544f78c4d3eef628f635c2b77b4.apk

    • Size

      1.0MB

    • MD5

      7b5ca7af7560e1e00a53e3b2da398e8d

    • SHA1

      d553b5b5fdb8e5b9c8bf291039820b4ff30ace87

    • SHA256

      18c5bf8ee185102b2cffb7e19ea9480113e94544f78c4d3eef628f635c2b77b4

    • SHA512

      1c416cc854000256adb6d2e34b401ff53d919aa503e40b9153186669521840efb67f9affe698911c6acb487ed918dc01e4aebbf32eb3e81b1bb5dd4e29237295

    • SSDEEP

      24576:a/xMjXBYdbtCk1w72Ctm/8Hf95fVkbLXZVs5A0w45:aZbnK72CcMfb9ULiA0w45

    Score
    10/10
    hydrabankerinfostealertrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks