hydra | 5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f

Analysis

max time kernel
1177687s
max time network
159s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
16-09-2022 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f.apk
Size

2.5MB
MD5

9dce53cc6e6b6dac4fb6809c91dfc65a
SHA1

cc0b6bb5f40418f8c8acfd76c2c257a386820a27
SHA256

5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f
SHA512

9ad44686ecb65fb205b9854b5870474b3dbb544b5e186bc092c2b0e9bb603f473ba24d59eca07c9da95bf335524e3a5320ef9ef2949729dfd0a7b6889e4979e8
SSDEEP

49152:yczkN3OFFeI5f+bByP3p0vTx6PrSeojWfTp7e4GgBgl1thgg2wSiID3Kv8g8Cdu3:VtFFeWfmB0ZI6TD7p7Gggf2wnID388oI

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://kartofcar.com

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral2/memory/4949-0.dex	family_hydra

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json	4949	com.avocado.gold

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	ip-api.com
52	ip-api.com

Reads information about phone network operator.

com.avocado.gold
1⤵
- Loads dropped Dex/Jar
PID:4949

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json

Filesize
1.3MB

MD5
de2bc4d995adeaa259be75718eab2da9

SHA1
d7c11394c80f73c2e8eaaa5b5fbec00679271f78

SHA256
cfb95085a3727789699526f18d85749a8e648b14ad4679001766570af4d75d2b

SHA512
38713a8f08f48f42e2e299f180b72f794699f7d709112fd17388f16b7f3854e957a9004b3e22a3b48225ab8d92390ea84648f8f193384239eb96cad462d76daa

Download Submit
/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json

Filesize
3.6MB

MD5
cfb5c86edf547357531103d076f35e01

SHA1
d8a32283df1506c36294c65b148df9cb0af48564

SHA256
e852f1c8caba9b5cf725349f294a9a783ea2c89f8bd8f301d9b9cbbc5274182f

SHA512
69f65d11b4f28192a659b8dcf335080152dc69fb2847e34fc4f4a5840fb8fc25a04b7437e0e67662571c602f4ded9ad94070191c0d33bd46db14dddfdad1d0ce

Download Submit
/data/user/0/com.avocado.gold/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit
/data/user/0/com.avocado.gold/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
b120b6423676916e3194bf71df157793

SHA1
f39ce1b41b7afe1977db45825cf6aa91a4e400b9

SHA256
77058bcf20d243287e1d2cbb9b713ffa74fdd8cf694b7c0ccd9f50d06fd4fc0c

SHA512
328709d49b108d187563494fcefe1c37dd5dd48c07889179a2108359a96835ee82a7f8dd3197664bd070f88992a1344e487c6ed141ecc09cbc86bfefab86064a

Download Submit