Overview

overview

10

Static

static

7

31fd040e83...cf.apk

android-9-x86

10

31fd040e83...cf.apk

android-10-x64

10

31fd040e83...cf.apk

android-11-x64

10

Analysis

  • max time kernel
    3483463s
  • max time network
    131s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    20-01-2023 14:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    31fd040e83679096a6204f20a7b4b3e4f587fd2d20b3ed4408550f64b3fafbcf.apk

  • Size

    2.1MB

  • MD5

    3ee8cd8a2fba850f954c8c8af84babd6

  • SHA1

    d2a6b249f009c5a628bbea4986b72e7be6a4e32a

  • SHA256

    31fd040e83679096a6204f20a7b4b3e4f587fd2d20b3ed4408550f64b3fafbcf

  • SHA512

    003d400ffd57a3adc68b9071c801577a1ed5ad27d763d2fc312a1c4d3c9f5eb72ad9c327c73920ee644d6c64fa2d2d9310801ccfbe28f9e3368b80effb69efbd

  • SSDEEP

    24576:Q77t4o5+UWRW3GHF5J3oijoeapmKVVcSnC5BZ9qxI+4kAHfN79vWTaTzG+6wpLM2:U7T80Wl5J3n2wK7hDaHl79q+6fLmdhr9

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.anxiety.close
    1⤵
    • Loads dropped Dex/Jar
    PID:4705

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json
    Filesize

    239KB

    MD5

    cb1b4c05867e314b8e7ae2ae11aa9fdd

    SHA1

    e30b9fc9b4ee86fe91117be3163ed12ab953b047

    SHA256

    714d32e72f00dc4d99d8ddf66d0c3e998b4ae94a357bf37f38b010b5c7113fbb

    SHA512

    25cc495ef5c808b7cd7d25fb8340ba18c8c97243441946b528f08bc69b9a355cf706fd02f865390395634f7e1f0dc8a286fc747cfe728b87fdefd1b9e2fa8438

    Download Submit

  • /data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json
    Filesize

    574KB

    MD5

    4f7ca869e2a2aa71565ddd0213377ef4

    SHA1

    7d36e39122864983eefeae7acda4c5895571aefb

    SHA256

    885da90d332750c7f2fef12a1fc61d9aae32a323b0bd13b2309bbc6ee3f221e5

    SHA512

    70097ab3164541abeb0aa661c7d92a1d4fd1f1b5deb7b605a5e510d7bfd84622f143305846fc6b31be0e5d7015bb56eca7fbf6063e84d840b7cd3bd07a4f500f

    Download Submit

  • /data/user/0/com.anxiety.close/shared_prefs/pref_name_setting.xml
    Filesize

    131B

    MD5

    bcf94f72cdb7396c9bfbeff8d2cf3c1f

    SHA1

    5963ef91c1de739a26dda0a5e82e62049ec41c18

    SHA256

    ed33ede60383755fb6870c6257e459b288c1e1f04ba76db9589aa470ea6b646e

    SHA512

    47a3ec829766e32b7c5f96f011aeb81f510367d1ebc96d2d92d83dc7331e338d27ff118e17284abb6a8d593b11a169f8ec3dfa93d34bdd300ffbcdd46a18c34a

    Download Submit