Overview

overview

10

Static

static

7

574897127d...d6.apk

android-10-x64

10

574897127d...d6.apk

android-11-x64

10

574897127d...d6.apk

android-9-x86

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8225596219.zip

  • Size

    3.2MB

  • Sample

    221022-h2hpqsbdd7

  • MD5

    1f1f98895c239e0681810a10888ba199

  • SHA1

    443b14f3fcf0781f260aafd9ddb4c558bc0dc966

  • SHA256

    60df7c2041df50055a5c68749e34f3780f6962d4ed1a6944b1b67ecee913f25d

  • SHA512

    1ff1866f65efa59bcb61517c37d5b9c8a4c0dab5a4b8aee0c2d4df206c1e272d8217e0ae93dcd459a05075388d0cc566799885a90da9499c4ebeb2b72a8de4fe

  • SSDEEP

    98304:5Ec3VRRiyoaiU8GtML57BvNrGafYmNGTs/:Sc3hiyGjyu7BvtDJn/

Score
10/10
hydraandroidbankerevasioninfostealerstealthtrojan

Malware Config

Extracted

Family

hydra

C2

http://patrikvillalobos43.top

Targets

    • Target

      574897127da229e7a7162b39bd20ba4becb89fc6fdfcf303a20deb1f456aead6

    • Size

      3.3MB

    • MD5

      a121f64c01e31eaf2c4f896c9d596182

    • SHA1

      2ac7b5d2882caef3a27b263e54d2acc2c888cae6

    • SHA256

      574897127da229e7a7162b39bd20ba4becb89fc6fdfcf303a20deb1f456aead6

    • SHA512

      2dd00b4b454f10b00729c45f3d1d3b7024f58b6ada7d89236a62ca620e4e874b2c6cd71027ffb5a9a0b1f88d5b20403108fd97537a4e38a4102d396628ff9ac9

    • SSDEEP

      98304:GYNqFXbZBArOViBsKgPErzLUV9nS3AA6YyWPTYghI8i/:Gy0DAKViBePE3qnmkYKghI8I

    Score
    10/10
    hydrabankerinfostealertrojanevasionstealth

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Removes its main activity from the application launcher

      stealthtrojan

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks