hydra | 5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f

Analysis

max time kernel
1177687s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
16-09-2022 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f.apk
Size

2.5MB
MD5

9dce53cc6e6b6dac4fb6809c91dfc65a
SHA1

cc0b6bb5f40418f8c8acfd76c2c257a386820a27
SHA256

5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f
SHA512

9ad44686ecb65fb205b9854b5870474b3dbb544b5e186bc092c2b0e9bb603f473ba24d59eca07c9da95bf335524e3a5320ef9ef2949729dfd0a7b6889e4979e8
SSDEEP

49152:yczkN3OFFeI5f+bByP3p0vTx6PrSeojWfTp7e4GgBgl1thgg2wSiID3Kv8g8Cdu3:VtFFeWfmB0ZI6TD7p7Gggf2wnID388oI

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://kartofcar.com

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral3/memory/4430-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.avocado.gold
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.avocado.gold

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json	4430	com.avocado.gold

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.avocado.gold

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
57	ip-api.com

Reads information about phone network operator.

com.avocado.gold
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
PID:4430

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json

Filesize
1.3MB

MD5
de2bc4d995adeaa259be75718eab2da9

SHA1
d7c11394c80f73c2e8eaaa5b5fbec00679271f78

SHA256
cfb95085a3727789699526f18d85749a8e648b14ad4679001766570af4d75d2b

SHA512
38713a8f08f48f42e2e299f180b72f794699f7d709112fd17388f16b7f3854e957a9004b3e22a3b48225ab8d92390ea84648f8f193384239eb96cad462d76daa

Download Submit
/data/user/0/com.avocado.gold/app_DynamicOptDex/cEaX.json

Filesize
3.6MB

MD5
cfb5c86edf547357531103d076f35e01

SHA1
d8a32283df1506c36294c65b148df9cb0af48564

SHA256
e852f1c8caba9b5cf725349f294a9a783ea2c89f8bd8f301d9b9cbbc5274182f

SHA512
69f65d11b4f28192a659b8dcf335080152dc69fb2847e34fc4f4a5840fb8fc25a04b7437e0e67662571c602f4ded9ad94070191c0d33bd46db14dddfdad1d0ce

Download Submit
/data/user/0/com.avocado.gold/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit
/data/user/0/com.avocado.gold/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
48bd54e76754f8ba3bc869291c0aa539

SHA1
c93780bf9a273ca12b808aed2fabe01fb333f8b6

SHA256
6675bb9b48ec5c4935ebc5436773338267a70d85ca0f26763fcc8e6b87c98f84

SHA512
7679a0357d79471fc505319b961f72c04a5e186a5f64d2f09f61c5b1ec673ab8437f8cd9a7fac6ceeb4b45a4209cdb54380e9a44e161a189d6bbebdb235d705e

Download Submit