hydra | 18c5bf8ee185102b2cffb7e19ea9480113e94544f78c4d3eef628f635c2b77b4

Analysis

max time kernel
1102714s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
15/09/2022, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18c5bf8ee185102b2cffb7e19ea9480113e94544f78c4d3eef628f635c2b77b4.apk
Size 1.0MB
Sample220915-sl7n2adde6
SHA256 18c5bf8ee185102b2cffb7e19ea9480113e94544f78c4d3eef628f635c2b77b4
MD5 7b5ca7af7560e1e00a53e3b2da398e8d
SHA1 d553b5b5fdb8e5b9c8bf291039820b4ff30ace87
SHA512 1c416cc854000256adb6d2e34b401ff53d919aa503e40b9153186669521840efb67f9affe698911c6acb487ed918dc01e4aebbf32eb3e81b1bb5dd4e29237295
SSDEEP 24576:a/xMjXBYdbtCk1w72Ctm/8Hf95fVkbLXZVs5A0w45:aZbnK72CcMfb9ULiA0w45
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://laurenwarren1566.top

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral3/memory/4579-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pretty.flock
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.pretty.flock

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.pretty.flock/app_DynamicOptDex/NFxRTXU.json	4579	com.pretty.flock

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
52	ip-api.com

Reads information about phone network operator.

com.pretty.flock
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4579

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

NFxRTXU.json

Path /data/user/0/com.pretty.flock/app_DynamicOptDex/NFxRTXU.json
Size 231KB
SHA256 d1413e17fcd2bc60e0273d1f95226e7d0d7c38d89aeffab041d5d7f9ed6f24d0
MD5 013c636eab0b61fe2cc47ff1ef8c166b
SHA1 43c1e802c1498cd7bb498bd158a07d93dc13ae81
SHA512 e81a2d0e5bc965c1585e8183432cdc3babbb4b369028cecb65f0a0025b5e5a8b5c265ab86f9bdc810121b03206dc26dfd4741111656a9992aa3e500c76dcdb6b
SSDEEP 6144:HsBmbTpbOjmO7w4l0Xl0EhXZywmgHih7U+rAUPC7vazL5VEu:/BbOj97w4GuElZy4K7V2AL5R
MD5 SHA1 SHA512 SSDEEP

Submit Download