Overview

overview

10

Static

static

7

481598d7c1...f4.apk

android-9-x86

10

481598d7c1...f4.apk

android-10-x64

10

481598d7c1...f4.apk

android-11-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    481598d7c10e3dfd538e8c21141ab337c2074047227a58f8f639eb374e971cf4.zip
  • Size 1.9MB
  • Sample230120-ry5vjabb66
  • SHA256 5df20525d7148aa46400d10794cb512cfd116bda28bb9b0ba96d07a4b4bb179d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
hydraandroidbankerinfostealertrojan

Malware Config

Extracted

Family

  • hydra

C2

  • http://lanagarza441.lol

Targets

    • Target
      481598d7c10e3dfd538e8c21141ab337c2074047227a58f8f639eb374e971cf4
    • Size 2.0MB
    • SHA256 481598d7c10e3dfd538e8c21141ab337c2074047227a58f8f639eb374e971cf4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    hydrabankerinfostealertrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Hydra payload

    • Makes use of the framework's Accessibility service.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks