hydra | 494282bb7fb9c55c1f1405f61e7a13846f8a04f0d87cf9480d4a862a9c61fe6a

Analysis

max time kernel
3483463s
max time network
131s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
20-01-2023 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31fd040e83679096a6204f20a7b4b3e4f587fd2d20b3ed4408550f64b3fafbcf.apk
Size

2.1MB
MD5

3ee8cd8a2fba850f954c8c8af84babd6
SHA1

d2a6b249f009c5a628bbea4986b72e7be6a4e32a
SHA256

31fd040e83679096a6204f20a7b4b3e4f587fd2d20b3ed4408550f64b3fafbcf
SHA512

003d400ffd57a3adc68b9071c801577a1ed5ad27d763d2fc312a1c4d3c9f5eb72ad9c327c73920ee644d6c64fa2d2d9310801ccfbe28f9e3368b80effb69efbd
SSDEEP

24576:Q77t4o5+UWRW3GHF5J3oijoeapmKVVcSnC5BZ9qxI+4kAHfN79vWTaTzG+6wpLM2:U7T80Wl5J3n2wK7hDaHl79q+6fLmdhr9

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json	family_hydra

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.anxiety.close

ioc pid process

/data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json 4705 com.anxiety.close
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

27 ip-api.com
Reads information about phone network operator.

ioc	pid	process
/data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json	4705	com.anxiety.close

flow	ioc
27	ip-api.com

com.anxiety.close
1⤵
- Loads dropped Dex/Jar
PID:4705

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json
Filesize
239KB

MD5
cb1b4c05867e314b8e7ae2ae11aa9fdd

SHA1
e30b9fc9b4ee86fe91117be3163ed12ab953b047

SHA256
714d32e72f00dc4d99d8ddf66d0c3e998b4ae94a357bf37f38b010b5c7113fbb

SHA512
25cc495ef5c808b7cd7d25fb8340ba18c8c97243441946b528f08bc69b9a355cf706fd02f865390395634f7e1f0dc8a286fc747cfe728b87fdefd1b9e2fa8438

Download Submit
/data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json
Filesize
574KB

MD5
4f7ca869e2a2aa71565ddd0213377ef4

SHA1
7d36e39122864983eefeae7acda4c5895571aefb

SHA256
885da90d332750c7f2fef12a1fc61d9aae32a323b0bd13b2309bbc6ee3f221e5

SHA512
70097ab3164541abeb0aa661c7d92a1d4fd1f1b5deb7b605a5e510d7bfd84622f143305846fc6b31be0e5d7015bb56eca7fbf6063e84d840b7cd3bd07a4f500f

Download Submit
/data/user/0/com.anxiety.close/app_DynamicOptDex/oat/cFyLWJb.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.anxiety.close/shared_prefs/pref_name_setting.xml
Filesize
131B

MD5
bcf94f72cdb7396c9bfbeff8d2cf3c1f

SHA1
5963ef91c1de739a26dda0a5e82e62049ec41c18

SHA256
ed33ede60383755fb6870c6257e459b288c1e1f04ba76db9589aa470ea6b646e

SHA512
47a3ec829766e32b7c5f96f011aeb81f510367d1ebc96d2d92d83dc7331e338d27ff118e17284abb6a8d593b11a169f8ec3dfa93d34bdd300ffbcdd46a18c34a

Download Submit