hydra | 75b693bb2da7c3c94ceb07b88ff9bee0dccaad15425e56344e415addbcf3737c

Analysis

max time kernel
2305371s
max time network
133s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
18-11-2022 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Google_Play_Store.apk
Size

3.1MB
MD5

06cf10298c93ba089b7d6ff8dc83fdb1
SHA1

75bfb5c86bed1e4fa431620163b1707e0645b083
SHA256

75b693bb2da7c3c94ceb07b88ff9bee0dccaad15425e56344e415addbcf3737c
SHA512

2d4508e8d563351ac1699f776b2e632cbfc5f6e967fa1a1a05b9d4098eb3a3b7e7d83400032bb44f0cc1144da1e0e1c1881e249bea9eda0ffece0d3edc7c1bb9
SSDEEP

98304:UvLCmQAVcZff+/baymELAkyzjh4GwnO3WDWMgk:UumQ2cZfG/baymiAkyzj7wnOG5gk

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://aykomediki.net

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4152-0.dex	family_hydra
behavioral1/memory/4098-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.wagon.track
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.wagon.track

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.wagon.track/app_DynamicOptDex/OdyqAaN.json	4152	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wagon.track/app_DynamicOptDex/OdyqAaN.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.wagon.track/app_DynamicOptDex/oat/x86/OdyqAaN.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.wagon.track/app_DynamicOptDex/OdyqAaN.json	4098	com.wagon.track

com.wagon.track
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4098
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wagon.track/app_DynamicOptDex/OdyqAaN.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.wagon.track/app_DynamicOptDex/oat/x86/OdyqAaN.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.wagon.track/app_DynamicOptDex/OdyqAaN.json

Filesize
1.6MB

MD5
281bbe18016d45aa9798a7fd3d4700f6

SHA1
0b342c1a181b9acaa009b0ef8220396d4cef89f3

SHA256
1ad48872e0643b81541465070ee063aa115bf6fed538e252f745ae34f574b41b

SHA512
600e0a742b475b1ec93095e126befb920a490f90bce605114aea7c11d91a0c4b6a18dfe4a9fe83a5fb8da800bbfec0ca33732e9ce4a4dc5bb9718e57271049ba

Download Submit
/data/user/0/com.wagon.track/app_DynamicOptDex/OdyqAaN.json

Filesize
4.4MB

MD5
e9613f4e53cd9ec40ef7558f3c2f8e34

SHA1
e950b1f9b4a1c83c1077a86a7323e7387a698b9e

SHA256
90e9f8565aa494b879b4d4f456271a6fe4950f8bd30a9aa59ee0f5b319680cd7

SHA512
94263d6ff74e86e87d828bfb44fae2e8923e09c3318120a69fbbd0b3ab7f9a09b6573d8f47f545096c1e97bbcccde504a73c9f9b686a8d0a460caa5a09e3e476

Download Submit
/data/user/0/com.wagon.track/app_DynamicOptDex/OdyqAaN.json

Filesize
4.4MB

MD5
5e778fa1b19c3d2f83f4547f9eb1fe3c

SHA1
bbeef5360c21685137d05c1a3eadbdf6626eb75a

SHA256
cda6b26aa4a8bf4d97933d4cb7d1caf1b537ac2539ed399925927b467fcb29e5

SHA512
d5c703400e1d182f7c5a8f575a27b30ed0afdc8029d148700101dc890ea97b683471280f68e9b46462b48b28653486de8bd615cecf7cd67d81df2c8e605fca9f

Download Submit
/data/user/0/com.wagon.track/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit
/data/user/0/com.wagon.track/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
728e6166860b1c087e5a010fd4f3e4ed

SHA1
3c6baf820db0195fe91f9dd44040376364d2a3ef

SHA256
eb47c380ccb98fe7a3491a00f088f98554ab174626227fdf73894d21286c5dc4

SHA512
365921a1ab90e0752c191bcee25d71f2fd84158047446e73db049de41025965c42f65ac895d82adde4bee2099e726602e23b4b910797f7b9f9e5a2ea3a2be86c

Download Submit