hydra | eb2f45849072ef2f4d638ce47b4f5a7b277c4569896f756a1bdc69d519530f79

Analysis

max time kernel
1599453s
max time network
161s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
21-09-2022 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CoinbaseUpdate20.14.apk
Size

2.8MB
MD5

4a221804f5dec022c97fb357a9cfaef3
SHA1

d7ed8ef2bcfdd0a4d9dd80a55180cf24240a3121
SHA256

eb2f45849072ef2f4d638ce47b4f5a7b277c4569896f756a1bdc69d519530f79
SHA512

8669b638ace30100ab920940d2773248f2d557be993bfc75be21e473835f1027924c103ab36847d2d66337008534f18c539cdb3a32ab36324852300b3120480e
SSDEEP

49152:gczMN3P6UMvE2d8J+qE2WsSYuy3raEasn5KXyG7TLoGDtcX7LprG9:3Y6U8E2dgXE2mYuy3Hasn8XyGHLooars

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://lalabanda.com

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json	family_hydra

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.thank.sand

ioc pid process

/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json 4747 com.thank.sand
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

67 ip-api.com
74 ip-api.com
Reads information about phone network operator.

ioc	pid	process
/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json	4747	com.thank.sand

flow	ioc
67	ip-api.com
74	ip-api.com

com.thank.sand
1⤵
- Loads dropped Dex/Jar
PID:4747

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json
Filesize
1.3MB

MD5
99fc964a71a9da067d47320ff8e1ee7d

SHA1
6cff0e9f9a5932b68283da1bf74c3ebb5398d11a

SHA256
57794962be63ee1eb5a2cc575262209a493e85f6509471d97b0f2d6cea506119

SHA512
327f216912d7aeae22d4b2e18e6c19d5588583fd92dccebb78d1192129fb73c5e054379786147d20bda9721965969c0f22956f14c51773eebb10a7ca678763ca

Download Submit
/data/user/0/com.thank.sand/app_DynamicOptDex/WH.json
Filesize
3.6MB

MD5
caca763a3aa5e71c4b321ec738b9b799

SHA1
192320735a2ff2588d3d645f7de2868220d15578

SHA256
58b7268cd1faaadd4cbca9df2435c9fa58a3310de6e83295517cf328bcf0584e

SHA512
58ed911ea59102b2264bb12486ce89269a663dc0771b9e06df41d4b90f1295e3a57b8bf0b966194efd466211abd920ee286522ba594565d6cc03df54f2d3cc3d

Download Submit
/data/user/0/com.thank.sand/app_DynamicOptDex/oat/WH.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.thank.sand/shared_prefs/pref_name_setting.xml
Filesize
131B

MD5
8c784bf37882678d5f37f35aa3f873a1

SHA1
5011e876eafb3dee550454541282cb891e2ba8e7

SHA256
75e59fd66073c89ab0ec0109c78b826b6e7075edd1e07b3fdafad4bbac7273f7

SHA512
537cb5000a6720f0f7877ce824e7c165c475b9b85bc1dd4f140b5e8d2e86edc2b1073f5dd08f2fa2e30defd54ae636399d7e497f117fa1732341e3be930ee1b7

Download Submit