hydra | 18c5bf8ee185102b2cffb7e19ea9480113e94544f78c4d3eef628f635c2b77b4

Analysis

max time kernel
1102713s
max time network
159s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
15-09-2022 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18c5bf8ee185102b2cffb7e19ea9480113e94544f78c4d3eef628f635c2b77b4.apk
Size

1.0MB
MD5

7b5ca7af7560e1e00a53e3b2da398e8d
SHA1

d553b5b5fdb8e5b9c8bf291039820b4ff30ace87
SHA256

18c5bf8ee185102b2cffb7e19ea9480113e94544f78c4d3eef628f635c2b77b4
SHA512

1c416cc854000256adb6d2e34b401ff53d919aa503e40b9153186669521840efb67f9affe698911c6acb487ed918dc01e4aebbf32eb3e81b1bb5dd4e29237295
SSDEEP

24576:a/xMjXBYdbtCk1w72Ctm/8Hf95fVkbLXZVs5A0w45:aZbnK72CcMfb9ULiA0w45

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://laurenwarren1566.top

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.pretty.flock/app_DynamicOptDex/NFxRTXU.json	family_hydra

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.pretty.flock

ioc pid process

/data/user/0/com.pretty.flock/app_DynamicOptDex/NFxRTXU.json 4909 com.pretty.flock
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

33 ip-api.com
44 ip-api.com
Reads information about phone network operator.

ioc	pid	process
/data/user/0/com.pretty.flock/app_DynamicOptDex/NFxRTXU.json	4909	com.pretty.flock

flow	ioc
33	ip-api.com
44	ip-api.com

com.pretty.flock
1⤵
- Loads dropped Dex/Jar
PID:4909

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.pretty.flock/app_DynamicOptDex/NFxRTXU.json
Filesize
231KB

MD5
013c636eab0b61fe2cc47ff1ef8c166b

SHA1
43c1e802c1498cd7bb498bd158a07d93dc13ae81

SHA256
d1413e17fcd2bc60e0273d1f95226e7d0d7c38d89aeffab041d5d7f9ed6f24d0

SHA512
e81a2d0e5bc965c1585e8183432cdc3babbb4b369028cecb65f0a0025b5e5a8b5c265ab86f9bdc810121b03206dc26dfd4741111656a9992aa3e500c76dcdb6b

Download Submit
/data/user/0/com.pretty.flock/app_DynamicOptDex/NFxRTXU.json
Filesize
540KB

MD5
f8fbd39fae1f279d2ee95d4b9b429df8

SHA1
e8295b4144b3eeb0b217f42754552fa52f73f9d6

SHA256
8cd48eebcb786d457864536178e41c4a97079606d1871d3c464eb741315fa01e

SHA512
93756886ce2ee37f762a8227bb21fc697441a969e1ea7eed5961d49a9e0bfaa90e9047572bc50ef2dabfd9d883595748c8ea529cdef38965e5d93aa3c085c935

Download Submit
/data/user/0/com.pretty.flock/app_DynamicOptDex/oat/NFxRTXU.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.pretty.flock/shared_prefs/pref_name_setting.xml
Filesize
131B

MD5
fcba2c4e01370038b4d48cbfece8b0b5

SHA1
a13ccd00e5f553b31541960b426808e1d32c07ea

SHA256
78e0714072dbcd3bfc265044975df2b63e7b4eccba8cc6d417d8a7df3cc0d91e

SHA512
34a876882cf4c2417fba2087183f753a181009e66b36f0ef9fd368f0f7e4b63386f0c0da97b22e07e7262ee4951e5385131b01140c217376ddac46680640b453

Download Submit