hydra | 99e0053475ecd6a22b0e22b2441f0bf0a407b36be54e7d8220bb284c0bd494a8

Analysis

max time kernel
3792836s
max time network
152s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
24-01-2023 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99e0053475ecd6a22b0e22b2441f0bf0a407b36be54e7d8220bb284c0bd494a8.apk
Size

3.4MB
MD5

2d21b43e6027134281324f460fc7fc66
SHA1

3d6bf52403c493e92140a52149898bc64f76e359
SHA256

99e0053475ecd6a22b0e22b2441f0bf0a407b36be54e7d8220bb284c0bd494a8
SHA512

029eb7cff7ccf74b93f4667c786ba50320deee4f5c49bbe3ec1ca0bc8a8d0c34038a52931ffce6fa309f6e71fb1771a69f27ba373fc35308abbbaf2254607f97
SSDEEP

49152:5uLlr42cZpvL7zVfiHqF3UzV1cx4ZfWmpPSPWR1m/s6/wLZfuY79S77qF6qW5bMN:5+UvL7zVfticx4ZfHmiEEZfpSKFGVrc

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4215-0.dex	family_hydra
behavioral1/memory/4130-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.glove.nurse
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.glove.nurse

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.glove.nurse/app_DynamicOptDex/WSyuNy.json	4215	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.glove.nurse/app_DynamicOptDex/WSyuNy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.glove.nurse/app_DynamicOptDex/oat/x86/WSyuNy.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.glove.nurse/app_DynamicOptDex/WSyuNy.json	4130	com.glove.nurse

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Reads information about phone network operator.

com.glove.nurse
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4130
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.glove.nurse/app_DynamicOptDex/WSyuNy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.glove.nurse/app_DynamicOptDex/oat/x86/WSyuNy.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4215

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.glove.nurse/app_DynamicOptDex/WSyuNy.json

Filesize
1.9MB

MD5
2f61c20d6202f0c3f9e07301c0c49c81

SHA1
a64d114637d1cdd09941d2ea3d9d7d4c06c5fd55

SHA256
2af4ac652af0e7e35f6ed09ba5b6137299b7769a93f426e133773f80f335a576

SHA512
4cc63a70e45a3e468480ecde2244265ee8162c9a972dc145b23c4d3d3ecd4aa621afa9e851f7f01692d59ea5bed69115346c52fef1a3cd0bdefdf98f02c73001

Download Submit
/data/user/0/com.glove.nurse/app_DynamicOptDex/WSyuNy.json

Filesize
5.0MB

MD5
0ec5cb3a53313f33049baa5373fb0549

SHA1
4936e757f6063ff214d84187c0f721011a7eb64d

SHA256
13e1a24263137a8b7e7f11d81c31ce1182f20277ddaa1726d308babdb6085046

SHA512
b45da0035af3c4e530f1cdee658094cd89a539a01068288a93fd14d614b147e7c1c5b769c225878859b6da71ece39bfd010ca825f67cfa1a8792117cb34d7614

Download Submit
/data/user/0/com.glove.nurse/app_DynamicOptDex/WSyuNy.json

Filesize
5.0MB

MD5
aac2dcd77392344f8dd31f4f01a57ce9

SHA1
5c7f8906901da794dc630d37cd9f501d44be6adb

SHA256
50ccc8e8c22a41b020f0f991395551f3f0fb683eae4aa88fa9333b4b3fa60a86

SHA512
1a9733330cb198be78d147d590a59735d1bcb3f9f56f2134e977b123d15ff81a254a684521cca3f2ec1fa498d64e8a79e5c1f55dd2f4ae62d8074edd8d8472e9

Download Submit
/data/user/0/com.glove.nurse/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
506de2394db81b149a145b330a10dea5

SHA1
929c515ef3243b5fcfb2ec39df6d4bcc0e2b8633

SHA256
40be6a3a193a96906398f907a77d9f0a519fad372474c3026c64b8af40400e4c

SHA512
a13dbc0313efb657cacc122d3a4ab6359a3efe5d32d716d4ae58eb6635772988b1429a21797ea0799bf206ac4daa969c5f9dd27d237c51068f75ebce0a73194b

Download Submit
/data/user/0/com.glove.nurse/shared_prefs/pref_name_setting.xml

Filesize
192B

MD5
82b1c0fa8d694733016002bba86a780d

SHA1
20853762aa2d81f6eb8bd7c52a6ffc20c7de26f6

SHA256
a9ba8db05836988efadddbd59bf4cd4427a5257224cee1d90908324296b3e8d0

SHA512
65502f6fe2ded003e984371aae26efdcb3fbd1df4ae93d2ee1115ed350cdf15d2c05005e4b54a767b6b50914a4c90e1a3d992bf0ccc4690ee4c7050abce0bed2

Download Submit