Overview

overview

10

Static

static

7

3971b2bbb2...15.apk

android-9-x86

10

3971b2bbb2...15.apk

android-10-x64

10

3971b2bbb2...15.apk

android-11-x64

10

Analysis

  • max time kernel
    2651058s
  • max time network
    165s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    10/01/2023, 23:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3971b2bbb2ce0491104c0cd834f929bdc0aa4a612a8cd4edaf17b9b9cbf1b915.apk

  • Size

    2.1MB

  • MD5

    6224051522f494907ccf147546344789

  • SHA1

    d348a6160285ab2b17bfa4ab12fb671bd5a62719

  • SHA256

    3971b2bbb2ce0491104c0cd834f929bdc0aa4a612a8cd4edaf17b9b9cbf1b915

  • SHA512

    04be2363b8e0264d57c6b637e05b14338f62066fa3260a926091f0749780b5c754249ad350c4d97a0a133b682591412f043fe69f8c015fedefc08284e14e4071

  • SSDEEP

    49152:AU108yB0ekNWLBSONPBOIesOHaTLVTdhZ:Ai08yBuNWBgr5Har

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

http://laurawright.top

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.sauce.awful
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:4525

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.sauce.awful/app_DynamicOptDex/iqJn.json
    Filesize

    239KB

    MD5

    f55b2706971c27e5154c8d180e5ce6ae

    SHA1

    422d54046cd2ae7371d6c7cc962748a23898260d

    SHA256

    df1be96165b0a15b6f4396aa7c6d0ced7e96b812360cd2d1cdff8f7a8e0fc77f

    SHA512

    8e5d94a385954f56d82627a40f95fc4885c085a158a35f4afbd46a13dfc1e47f67924b88b1ed5ff131db323b5a9079d23b57465092483d0f04bdb3c20752ae4a

    Download Submit

  • /data/user/0/com.sauce.awful/app_DynamicOptDex/iqJn.json
    Filesize

    574KB

    MD5

    4f7ca869e2a2aa71565ddd0213377ef4

    SHA1

    7d36e39122864983eefeae7acda4c5895571aefb

    SHA256

    885da90d332750c7f2fef12a1fc61d9aae32a323b0bd13b2309bbc6ee3f221e5

    SHA512

    70097ab3164541abeb0aa661c7d92a1d4fd1f1b5deb7b605a5e510d7bfd84622f143305846fc6b31be0e5d7015bb56eca7fbf6063e84d840b7cd3bd07a4f500f

    Download Submit

  • /data/user/0/com.sauce.awful/shared_prefs/pref_name_setting.xml
    Filesize

    131B

    MD5

    df93e7690ef7d565824605ed7284e08e

    SHA1

    a65de6b1dab3f4c217a4350ce6252b90e51999a6

    SHA256

    2d93c5b7e8c3e12ba2ce341b66a2c6b3c5c1a5b4a05376c79e2d79941c62a529

    SHA512

    e66140c06bb16d9a8554ed573a60b0471c007f2702f5129bb383ea9c13dc70a70780e0b09e05f6e31709a22846a61bb7df420fc64b5c3594d2c6e390adc13487

    Download Submit