hydra | 494282bb7fb9c55c1f1405f61e7a13846f8a04f0d87cf9480d4a862a9c61fe6a

Analysis

max time kernel
3483464s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
20-01-2023 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31fd040e83679096a6204f20a7b4b3e4f587fd2d20b3ed4408550f64b3fafbcf.apk
Size

2.1MB
MD5

3ee8cd8a2fba850f954c8c8af84babd6
SHA1

d2a6b249f009c5a628bbea4986b72e7be6a4e32a
SHA256

31fd040e83679096a6204f20a7b4b3e4f587fd2d20b3ed4408550f64b3fafbcf
SHA512

003d400ffd57a3adc68b9071c801577a1ed5ad27d763d2fc312a1c4d3c9f5eb72ad9c327c73920ee644d6c64fa2d2d9310801ccfbe28f9e3368b80effb69efbd
SSDEEP

24576:Q77t4o5+UWRW3GHF5J3oijoeapmKVVcSnC5BZ9qxI+4kAHfN79vWTaTzG+6wpLM2:U7T80Wl5J3n2wK7hDaHl79q+6fLmdhr9

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://lanagarza441.lol

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.anxiety.close

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.anxiety.close
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.anxiety.close

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.anxiety.close

ioc pid process

/data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json 4551 com.anxiety.close
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

50 ip-api.com
Reads information about phone network operator.

ioc	pid	process
/data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json	4551	com.anxiety.close

flow	ioc
50	ip-api.com

com.anxiety.close
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4551

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json
Filesize
239KB

MD5
cb1b4c05867e314b8e7ae2ae11aa9fdd

SHA1
e30b9fc9b4ee86fe91117be3163ed12ab953b047

SHA256
714d32e72f00dc4d99d8ddf66d0c3e998b4ae94a357bf37f38b010b5c7113fbb

SHA512
25cc495ef5c808b7cd7d25fb8340ba18c8c97243441946b528f08bc69b9a355cf706fd02f865390395634f7e1f0dc8a286fc747cfe728b87fdefd1b9e2fa8438

Download Submit
/data/user/0/com.anxiety.close/app_DynamicOptDex/cFyLWJb.json
Filesize
574KB

MD5
4f7ca869e2a2aa71565ddd0213377ef4

SHA1
7d36e39122864983eefeae7acda4c5895571aefb

SHA256
885da90d332750c7f2fef12a1fc61d9aae32a323b0bd13b2309bbc6ee3f221e5

SHA512
70097ab3164541abeb0aa661c7d92a1d4fd1f1b5deb7b605a5e510d7bfd84622f143305846fc6b31be0e5d7015bb56eca7fbf6063e84d840b7cd3bd07a4f500f

Download Submit
/data/user/0/com.anxiety.close/app_DynamicOptDex/oat/cFyLWJb.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.anxiety.close/shared_prefs/pref_name_setting.xml
Filesize
131B

MD5
0646654fe9af4b6a256edd915b7e702a

SHA1
9fcc7ecdf48e3e3a28d644c6dff32d5c15e351a8

SHA256
d4a15a0778944d547ad084f4da470b10a2eae9a7b8aaa0775f8f14e2974f3095

SHA512
9733a0a3bcdea714259a3e576a32f8c46a770a419ae5c8555db86bf75556e37bd724a1edfcb9cb381b3332770c6d3eba3fd11fba6256b19228eb37f5244878e6

Download Submit