Overview

overview

10

Static

static

7

267585b414...73.apk

android-9-x86

10

267585b414...73.apk

android-10-x64

10

267585b414...73.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    267585b414d3d754b6dcdbe25ead7d24790b0b0f8df942ec1f11a29df9eb8373.zip

  • Size

    1.8MB

  • Sample

    230110-3mpvqaaa44

  • MD5

    39d6582c2eae44302bec3f106a06dbe6

  • SHA1

    26de97e8d21d90adacf341b84c2e82b186d2cccf

  • SHA256

    cb541c24056673e95993c020f32b504536dbb42f19ea5eac595f81e32e547f47

  • SHA512

    f9e7f7aa8138f4341bb83c26d2d01c875a0fcd5af99e67864368a1990124a60ef6c360fdb88f7b5c61b6ef9a1c12aa7b595858464744d3598f86686b87a96c36

  • SSDEEP

    24576:69dVoB3pzgbHr7m5ptjUS11W5uB9RA9zwSAbYEFTZoUPDc61Hco71zFoRGj+ChQe:69ghpL1ki9czwj/RzPxH31ZoRGfV

Score
10/10
hydraandroidbankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

http://laurawright.top

Targets

    • Target

      267585b414d3d754b6dcdbe25ead7d24790b0b0f8df942ec1f11a29df9eb8373

    • Size

      2.1MB

    • MD5

      f3fa4e18b1312666eb4ca8875718d562

    • SHA1

      4d4825604e260df260166b5c2e37bb488f163fbe

    • SHA256

      267585b414d3d754b6dcdbe25ead7d24790b0b0f8df942ec1f11a29df9eb8373

    • SHA512

      02de88acf01757837f346b5dda4613285296beaaa0ef7370833222082b3abb055dc711077bdc41bad9b2bc760af6ca01c72a2b7584ecb363e4d8ed50b5631ec9

    • SSDEEP

      49152:a62C2xUAiAQHzpupPU/UgEeL4mHwb7wjimNxdhU:92C2xUJbiPUuqHwojk

    Score
    10/10
    hydrabankerinfostealertrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks