Overview

overview

10

Static

static

7

31fd040e83...cf.apk

android-9-x86

10

31fd040e83...cf.apk

android-10-x64

10

31fd040e83...cf.apk

android-11-x64

10

Analysis

  • max time kernel
    3483464s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    20-01-2023 14:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    31fd040e83679096a6204f20a7b4b3e4f587fd2d20b3ed4408550f64b3fafbcf.apk

  • Size

    2.1MB

  • MD5

    3ee8cd8a2fba850f954c8c8af84babd6

  • SHA1

    d2a6b249f009c5a628bbea4986b72e7be6a4e32a

  • SHA256

    31fd040e83679096a6204f20a7b4b3e4f587fd2d20b3ed4408550f64b3fafbcf

  • SHA512

    003d400ffd57a3adc68b9071c801577a1ed5ad27d763d2fc312a1c4d3c9f5eb72ad9c327c73920ee644d6c64fa2d2d9310801ccfbe28f9e3368b80effb69efbd

  • SSDEEP

    24576:Q77t4o5+UWRW3GHF5J3oijoeapmKVVcSnC5BZ9qxI+4kAHfN79vWTaTzG+6wpLM2:U7T80Wl5J3n2wK7hDaHl79q+6fLmdhr9

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

http://lanagarza441.lol

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.anxiety.close
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:4551

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json
    Filesize

    239KB

    MD5

    cb1b4c05867e314b8e7ae2ae11aa9fdd

    SHA1

    e30b9fc9b4ee86fe91117be3163ed12ab953b047

    SHA256

    714d32e72f00dc4d99d8ddf66d0c3e998b4ae94a357bf37f38b010b5c7113fbb

    SHA512

    25cc495ef5c808b7cd7d25fb8340ba18c8c97243441946b528f08bc69b9a355cf706fd02f865390395634f7e1f0dc8a286fc747cfe728b87fdefd1b9e2fa8438

    Download Submit

  • /data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json
    Filesize

    574KB

    MD5

    4f7ca869e2a2aa71565ddd0213377ef4

    SHA1

    7d36e39122864983eefeae7acda4c5895571aefb

    SHA256

    885da90d332750c7f2fef12a1fc61d9aae32a323b0bd13b2309bbc6ee3f221e5

    SHA512

    70097ab3164541abeb0aa661c7d92a1d4fd1f1b5deb7b605a5e510d7bfd84622f143305846fc6b31be0e5d7015bb56eca7fbf6063e84d840b7cd3bd07a4f500f

    Download Submit

  • /data/user/0/com.anxiety.close/shared_prefs/pref_name_setting.xml
    Filesize

    131B

    MD5

    0646654fe9af4b6a256edd915b7e702a

    SHA1

    9fcc7ecdf48e3e3a28d644c6dff32d5c15e351a8

    SHA256

    d4a15a0778944d547ad084f4da470b10a2eae9a7b8aaa0775f8f14e2974f3095

    SHA512

    9733a0a3bcdea714259a3e576a32f8c46a770a419ae5c8555db86bf75556e37bd724a1edfcb9cb381b3332770c6d3eba3fd11fba6256b19228eb37f5244878e6

    Download Submit