hydra | 5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f

Analysis

max time kernel
1177687s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
16-09-2022 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f.apk
Size

2.5MB
MD5

9dce53cc6e6b6dac4fb6809c91dfc65a
SHA1

cc0b6bb5f40418f8c8acfd76c2c257a386820a27
SHA256

5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f
SHA512

9ad44686ecb65fb205b9854b5870474b3dbb544b5e186bc092c2b0e9bb603f473ba24d59eca07c9da95bf335524e3a5320ef9ef2949729dfd0a7b6889e4979e8
SSDEEP

49152:yczkN3OFFeI5f+bByP3p0vTx6PrSeojWfTp7e4GgBgl1thgg2wSiID3Kv8g8Cdu3:VtFFeWfmB0ZI6TD7p7Gggf2wnID388oI

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://kartofcar.com

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4125-0.dex	family_hydra
behavioral1/memory/4077-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.avocado.gold
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.avocado.gold

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json	4125	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.avocado.gold/app_DynamicOptDex/oat/x86/cEaX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json	4077	com.avocado.gold

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	ip-api.com

Reads information about phone network operator.

com.avocado.gold
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4077
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.avocado.gold/app_DynamicOptDex/oat/x86/cEaX.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4125

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json

Filesize
1.3MB

MD5
de2bc4d995adeaa259be75718eab2da9

SHA1
d7c11394c80f73c2e8eaaa5b5fbec00679271f78

SHA256
cfb95085a3727789699526f18d85749a8e648b14ad4679001766570af4d75d2b

SHA512
38713a8f08f48f42e2e299f180b72f794699f7d709112fd17388f16b7f3854e957a9004b3e22a3b48225ab8d92390ea84648f8f193384239eb96cad462d76daa

Download Submit
/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json

Filesize
3.6MB

MD5
38f35cf2d348249c5ab19c9b10e11627

SHA1
b91380e229aafddbf8c0c73d45db0e136df5b2e6

SHA256
f1168fdf0dfaecd4656e318defad9046a145abb6d4c6e42a459830187fb4181f

SHA512
46790d8263bd08639e77a8ef0f2d7499d8c47f6753eb474ec4146c465a635c72fbb9ddc285407a53ac00e6342fc8a35587713f92cd474419c1c4005198d5a189

Download Submit
/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json

Filesize
3.6MB

MD5
cfb5c86edf547357531103d076f35e01

SHA1
d8a32283df1506c36294c65b148df9cb0af48564

SHA256
e852f1c8caba9b5cf725349f294a9a783ea2c89f8bd8f301d9b9cbbc5274182f

SHA512
69f65d11b4f28192a659b8dcf335080152dc69fb2847e34fc4f4a5840fb8fc25a04b7437e0e67662571c602f4ded9ad94070191c0d33bd46db14dddfdad1d0ce

Download Submit
/data/user/0/com.avocado.gold/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit
/data/user/0/com.avocado.gold/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
ce970ce915dc69aeaeb54877668e740d

SHA1
45f4a6d85780867c174ab2a4c307f8044792316c

SHA256
79a84050b2c188d92371f7897cd93ac10ed8e4fcf73dacfd4977ae4f01324ffc

SHA512
78f8fecfff23bdc5324bf2d0d906338cb62b7cec9bdcb1a5f18fd4090692c1fe8f59be32404050ca4c3a54838e4f429573027eecb455e3590fe0dabecbc593de

Download Submit