Overview

overview

10

Static

static

7

test.apk

android-9-x86

10

Resubmissions

14-11-2022 10:39

221114-mqcfssbh8s 10

03-11-2022 12:00

221103-n6p79scbfr 10

Analysis

  • max time kernel
    1971635s
  • max time network
    145s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    14-11-2022 10:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    test.apk

  • Size

    2.2MB

  • MD5

    6544dc1ad079fda5132967a23d1afde8

  • SHA1

    2f1caac13dfb0e0001a301302e95ac4e0a28f2fe

  • SHA256

    dd81805033901b13456bc9ab96c0aaa0c4f131b13e4b7f5a5aa344554a0c198f

  • SHA512

    1e4fc15ed8b4cbc3e360c7b6a52728afaccf20e0e28f7463fdde5027744d377d70bf65f315efc6128711201cdf0d7e7218c2eae9e9f70fbf353cfc6921e34dec

  • SSDEEP

    49152:AeqwjEh2s6z63DhUE8LyitImj2DeNdo84ef:AxWEhi8+DDCDeNdqef

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

http://playstoresgooglese.net

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 2 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.usual.wheat
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:4059
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.usual.wheat/app_DynamicOptDex/oat/x86/OCW.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json
    Filesize

    1.3MB

    MD5

    7904660453b985caf2a5f51cef3fa4ae

    SHA1

    2dda1d8f0d3261f74dad35ee862b8d71f3ebb56a

    SHA256

    7edc0858e9dc7a942be2b02a5e9ddd509af66643931f9e48faa460fc7de6a69b

    SHA512

    fb17c73de3064bb8650563acb81ddbaccef87708a1e122ea1516af2948a49a50674e761c06b150cb2fce14e79a50a12d7d0f4bd86e4390d2104aabc57c5e3ae3

    Download Submit
  • /data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json
    Filesize

    3.6MB

    MD5

    adb83a950dde9edccd47314e4b668e13

    SHA1

    b511b7b1fbd015ca07c3112b0fc651764dd16b61

    SHA256

    dc01317d431e3997672fef78cd5eb22774a8133270484bc81365eb0b539340be

    SHA512

    c87fa6d7f7f0190058834b819cabe9737985857415e77df6d59d3da790c2d6fa92c95234a7a840e993ba4b66433449e6bce0ba668a0b45c32e570316ab3174ec

    Download Submit
  • /data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json
    Filesize

    3.6MB

    MD5

    741cdd075f64fe6837fbe87820cc1b08

    SHA1

    4b15772dbbd1570b9e287e98802f5aff1c8a4537

    SHA256

    b8beaf60fb31eb7e7f58861f8e30e3f3904e1a19303d8860ff737ac4cbdf05c1

    SHA512

    cf78bcf76faa116cfe5cec05b4df501b9bc75669ef75acf92521bce4b20ce2fac3579a44bd7ab387d5bfc91ec03997ec3c160117d66f9c29b7a3bfd70afabc9e

    Download Submit
  • /data/user/0/com.usual.wheat/app_DynamicOptDex/OCW.json.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.usual.wheat/app_DynamicOptDex/oat/OCW.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.usual.wheat/app_DynamicOptDex/oat/x86/OCW.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.usual.wheat/app_DynamicOptDex/oat/x86/OCW.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.usual.wheat/app_apk/payload.apk
    Filesize

    8KB

    MD5

    8cce3aa643810151373688927ce2ab26

    SHA1

    926b101db2ac0d1468fbb81f8db333195df94c50

    SHA256

    ee90e99a9a8581b24ea36dbeded9833d5cdc217ee0d17430825b73359e56aab7

    SHA512

    c6450a1664e915563ad756fc70f72cb1a164e86acd65d90a2b3d5168a20ef92979ddf23473cfe40be578b6472ed7b22c908d37604b80871a99112a34b140e575

    Download Submit
  • /data/user/0/com.usual.wheat/shared_prefs/pref_name_setting.xml
    Filesize

    131B

    MD5

    790c83d97493bc2a4bf11d7f86b449bd

    SHA1

    b97f1be5f72a73e2a14b294fab53b86caba114a9

    SHA256

    3192f9edb62927fd6b23d53eed3439c3f6eeac0ee76ca16b684f28ba85f35b89

    SHA512

    a3adb47e60fa8af4bba42d314dd1653e09098430c380a3f66e0e0b26632f62e6fa7e3d02eb9edb22405323fb7330aeb417f01af755eb730ab7c3e33b02664302

    Download Submit