hydra | eb2f45849072ef2f4d638ce47b4f5a7b277c4569896f756a1bdc69d519530f79

Analysis

max time kernel
1423655s
max time network
151s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
19-09-2022 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CoinbaseUpdate20.14.apk
Size

2.8MB
MD5

4a221804f5dec022c97fb357a9cfaef3
SHA1

d7ed8ef2bcfdd0a4d9dd80a55180cf24240a3121
SHA256

eb2f45849072ef2f4d638ce47b4f5a7b277c4569896f756a1bdc69d519530f79
SHA512

8669b638ace30100ab920940d2773248f2d557be993bfc75be21e473835f1027924c103ab36847d2d66337008534f18c539cdb3a32ab36324852300b3120480e
SSDEEP

49152:gczMN3P6UMvE2d8J+qE2WsSYuy3raEasn5KXyG7TLoGDtcX7LprG9:3Y6U8E2dgXE2mYuy3Hasn8XyGHLooars

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://lalabanda.com

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4075-0.dex	family_hydra
behavioral1/memory/3999-0.dex	family_hydra

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.thank.sand
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.thank.sand
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.thank.sand

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json	4075	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.thank.sand/app_DynamicOptDex/oat/x86/WH.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json	3999	com.thank.sand

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
48	ip-api.com

Reads information about phone network operator.

com.thank.sand
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:3999
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.thank.sand/app_DynamicOptDex/oat/x86/WH.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4075

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json

Filesize
1.3MB

MD5
99fc964a71a9da067d47320ff8e1ee7d

SHA1
6cff0e9f9a5932b68283da1bf74c3ebb5398d11a

SHA256
57794962be63ee1eb5a2cc575262209a493e85f6509471d97b0f2d6cea506119

SHA512
327f216912d7aeae22d4b2e18e6c19d5588583fd92dccebb78d1192129fb73c5e054379786147d20bda9721965969c0f22956f14c51773eebb10a7ca678763ca

Download Submit
/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json

Filesize
3.6MB

MD5
ca8c4c351514a828d23a30e626352dd9

SHA1
eae4c7789c05b023dc44fbf44fa311763968ba46

SHA256
38150425460c48c76bd5f6e14665b923e00d58df8ce585f43261ecc0f57b6490

SHA512
0061a12ae02ddaf7a849bae512824059d829ea539e97d21d736ace24439820b407f7115e0c9cb73fcb68564d2d3efd2b9b6adec6a456acafec1a78f4a4030815

Download Submit
/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json

Filesize
3.6MB

MD5
caca763a3aa5e71c4b321ec738b9b799

SHA1
192320735a2ff2588d3d645f7de2868220d15578

SHA256
58b7268cd1faaadd4cbca9df2435c9fa58a3310de6e83295517cf328bcf0584e

SHA512
58ed911ea59102b2264bb12486ce89269a663dc0771b9e06df41d4b90f1295e3a57b8bf0b966194efd466211abd920ee286522ba594565d6cc03df54f2d3cc3d

Download Submit
/data/user/0/com.thank.sand/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit
/data/user/0/com.thank.sand/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
b1f8db600af124b719a20f30195f5db9

SHA1
62437d4ba7c73e6a05a16ace517900d76a09c977

SHA256
407d4bac8b31de62bc2787bd4a87fe416ed66ac6aa89432d14b601ee1b141ec1

SHA512
6e214a0c2f7e94697c9bf8d422f27703534e2ca548f41ea99e18af5225d127d87c65cbe32c58bea638b988ffedb93a4cb9eada940463d57743367b55e2dd7b1f

Download Submit