hydra | 99e0053475ecd6a22b0e22b2441f0bf0a407b36be54e7d8220bb284c0bd494a8

Analysis

max time kernel
3796449s
max time network
167s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
24-01-2023 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99e0053475ecd6a22b0e22b2441f0bf0a407b36be54e7d8220bb284c0bd494a8.apk
Size

3.4MB
MD5

2d21b43e6027134281324f460fc7fc66
SHA1

3d6bf52403c493e92140a52149898bc64f76e359
SHA256

99e0053475ecd6a22b0e22b2441f0bf0a407b36be54e7d8220bb284c0bd494a8
SHA512

029eb7cff7ccf74b93f4667c786ba50320deee4f5c49bbe3ec1ca0bc8a8d0c34038a52931ffce6fa309f6e71fb1771a69f27ba373fc35308abbbaf2254607f97
SSDEEP

49152:5uLlr42cZpvL7zVfiHqF3UzV1cx4ZfWmpPSPWR1m/s6/wLZfuY79S77qF6qW5bMN:5+UvL7zVfticx4ZfHmiEEZfpSKFGVrc

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral2/memory/4975-0.dex	family_hydra

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.glove.nurse/app_DynamicOptDex/WSyuNy.json	4975	com.glove.nurse

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
52	ip-api.com

Reads information about phone network operator.

com.glove.nurse
1⤵
- Loads dropped Dex/Jar
PID:4975

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.glove.nurse/app_DynamicOptDex/WSyuNy.json

Filesize
1.9MB

MD5
2f61c20d6202f0c3f9e07301c0c49c81

SHA1
a64d114637d1cdd09941d2ea3d9d7d4c06c5fd55

SHA256
2af4ac652af0e7e35f6ed09ba5b6137299b7769a93f426e133773f80f335a576

SHA512
4cc63a70e45a3e468480ecde2244265ee8162c9a972dc145b23c4d3d3ecd4aa621afa9e851f7f01692d59ea5bed69115346c52fef1a3cd0bdefdf98f02c73001

Download Submit
/data/user/0/com.glove.nurse/app_DynamicOptDex/WSyuNy.json

Filesize
5.0MB

MD5
aac2dcd77392344f8dd31f4f01a57ce9

SHA1
5c7f8906901da794dc630d37cd9f501d44be6adb

SHA256
50ccc8e8c22a41b020f0f991395551f3f0fb683eae4aa88fa9333b4b3fa60a86

SHA512
1a9733330cb198be78d147d590a59735d1bcb3f9f56f2134e977b123d15ff81a254a684521cca3f2ec1fa498d64e8a79e5c1f55dd2f4ae62d8074edd8d8472e9

Download Submit
/data/user/0/com.glove.nurse/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
1eaf03e7e56b3f9ac0ab731aa2a1058d

SHA1
5ac76357d829eb293d7977d2ba20bc8d931416b6

SHA256
e3bb9bcdfee95201af57b0d4112681c5dcb32bf15fd5dce051d38dfeefefdef9

SHA512
5bb13ab05497703c542978b65c7f2349e8eb1309302443401eb212981f8245bb9fa38753fa1a811e21f5193a3a5090eeb83e19746b781d976da370946f573872

Download Submit
/data/user/0/com.glove.nurse/shared_prefs/pref_name_setting.xml

Filesize
192B

MD5
99417ea044a957c9e0c113a419b1aa68

SHA1
1f73ca19b599cd3104c63b732f4d6f7965cbeb32

SHA256
b79f84e9822079773e2a7d1f2be8cf082261bc8d5d87c93cc19f15f8892aaaf2

SHA512
7e85ab639614a18c12d681e7dee4af7be8a91e94ad61d149806877edb376d4b061014b532cb71803e7e61df2797a3a420659663261f626508bb0dc4a9624c7b6

Download Submit