hydra | dd81805033901b13456bc9ab96c0aaa0c4f131b13e4b7f5a5aa344554a0c198f

Resubmissions

14-11-2022 10:39

221114-mqcfssbh8s 10

03-11-2022 12:00

221103-n6p79scbfr 10

Analysis

max time kernel
1026097s
max time network
158s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
03-11-2022 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.apk
Size

2.2MB
MD5

6544dc1ad079fda5132967a23d1afde8
SHA1

2f1caac13dfb0e0001a301302e95ac4e0a28f2fe
SHA256

dd81805033901b13456bc9ab96c0aaa0c4f131b13e4b7f5a5aa344554a0c198f
SHA512

1e4fc15ed8b4cbc3e360c7b6a52728afaccf20e0e28f7463fdde5027744d377d70bf65f315efc6128711201cdf0d7e7218c2eae9e9f70fbf353cfc6921e34dec
SSDEEP

49152:AeqwjEh2s6z63DhUE8LyitImj2DeNdo84ef:AxWEhi8+DDCDeNdqef

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://playstoresgooglese.net

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4097-0.dex	family_hydra
behavioral1/memory/4040-0.dex	family_hydra

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.usual.wheat
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.usual.wheat
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.usual.wheat

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json	4097	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.usual.wheat/app_DynamicOptDex/oat/x86/OCW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json	4040	com.usual.wheat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	ip-api.com

Reads information about phone network operator.

com.usual.wheat
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4040
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.usual.wheat/app_DynamicOptDex/oat/x86/OCW.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4097

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json

Filesize
1.3MB

MD5
7904660453b985caf2a5f51cef3fa4ae

SHA1
2dda1d8f0d3261f74dad35ee862b8d71f3ebb56a

SHA256
7edc0858e9dc7a942be2b02a5e9ddd509af66643931f9e48faa460fc7de6a69b

SHA512
fb17c73de3064bb8650563acb81ddbaccef87708a1e122ea1516af2948a49a50674e761c06b150cb2fce14e79a50a12d7d0f4bd86e4390d2104aabc57c5e3ae3

Download Submit
/data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json

Filesize
3.6MB

MD5
adb83a950dde9edccd47314e4b668e13

SHA1
b511b7b1fbd015ca07c3112b0fc651764dd16b61

SHA256
dc01317d431e3997672fef78cd5eb22774a8133270484bc81365eb0b539340be

SHA512
c87fa6d7f7f0190058834b819cabe9737985857415e77df6d59d3da790c2d6fa92c95234a7a840e993ba4b66433449e6bce0ba668a0b45c32e570316ab3174ec

Download Submit
/data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json

Filesize
3.6MB

MD5
741cdd075f64fe6837fbe87820cc1b08

SHA1
4b15772dbbd1570b9e287e98802f5aff1c8a4537

SHA256
b8beaf60fb31eb7e7f58861f8e30e3f3904e1a19303d8860ff737ac4cbdf05c1

SHA512
cf78bcf76faa116cfe5cec05b4df501b9bc75669ef75acf92521bce4b20ce2fac3579a44bd7ab387d5bfc91ec03997ec3c160117d66f9c29b7a3bfd70afabc9e

Download Submit
/data/user/0/com.usual.wheat/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit
/data/user/0/com.usual.wheat/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
ab389b700210fcb396b742695f9d0ee3

SHA1
834604b4a5332a8a5c651c32b824dc34aec9c4cb

SHA256
0cfbf5b1c576c70f3ea7fecc1752403feb6d8e078e26e227dca1963ebffa629e

SHA512
b44ff82eee6dda5b67be5ae6edd516af9c5d68ef0fc8605f89b44ff5fab3ba9e8e1b8b39bd24eae12b1af6cdc1563ffd235db95342e8a3db1e19f30901f6969e

Download Submit