hydra | 33c0433f45db19af9273a3be535bfc8901499eaf6771bbf68d146e50315a0910

Analysis

max time kernel
4267510s
max time network
127s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
20-03-2023 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33c0433f45db19af9273a3be535bfc8901499eaf6771bbf68d146e50315a0910.apk
Size

3.0MB
MD5

7b63a73cedf7b0bc91e1ef383025317f
SHA1

2586791ff2d25166ad739dc31c08c49769bcda0b
SHA256

33c0433f45db19af9273a3be535bfc8901499eaf6771bbf68d146e50315a0910
SHA512

c7dfdb5d4110ac3e435d76d256f0be6dee62a49b075eb1033384a7aee9b3fa845494d3ba37947f26231fe498de410afb0f093da141e16f58a865ad7bfa30fdb9
SSDEEP

98304:sZA3SwZbvscL5gGB8wqGVdwDDguRal/WL3++tIcM3:LgcSGB8LmwXjol/mO+tIcM3

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://taewcfas2s.com.de

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4154-0.dex	family_hydra
behavioral1/memory/4088-0.dex	family_hydra

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.travel.poverty
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.travel.poverty
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.travel.poverty

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.travel.poverty/app_DynamicOptDex/GlMkQm.json	4154	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.travel.poverty/app_DynamicOptDex/GlMkQm.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.travel.poverty/app_DynamicOptDex/oat/x86/GlMkQm.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.travel.poverty/app_DynamicOptDex/GlMkQm.json	4088	com.travel.poverty

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	ip-api.com

Reads information about phone network operator.

com.travel.poverty
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4088
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.travel.poverty/app_DynamicOptDex/GlMkQm.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.travel.poverty/app_DynamicOptDex/oat/x86/GlMkQm.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4154

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.travel.poverty/app_DynamicOptDex/GlMkQm.json

Filesize
1.6MB

MD5
b0b936b8bfa5dd462fd0515ad300e0fb

SHA1
50cae55b4128883af6b863447ca471bddd620ee9

SHA256
aea2d319c200c6652b6061c7902e0fc229737d1864440a4bb8c2227144906657

SHA512
6a0595a3c3a21d251eb186e67c5eb9479bc576ef4340fff59017d448c94c787701712e47f9f1764a3a03b0734b6b3689154d63a3ea9688fe7d3f6a6c27c94208

Download Submit
/data/user/0/com.travel.poverty/app_DynamicOptDex/GlMkQm.json

Filesize
4.4MB

MD5
bf6b6f849214bc3eafae4e592514dcf3

SHA1
31be96d30e8cc489244806bdcada6bc338b332d2

SHA256
99dce0adad6f2b29038c4fdc0b76adf58f7976d849f7a6cb6477a073de183a88

SHA512
b599437cba3e13dbdf1feceecbd4dab1673d251fe2b37266045724ce98f81bd904214c37cea6a75e30219e920a56e957eb0bf8f529bc0c5e21e89ce22bc28352

Download Submit
/data/user/0/com.travel.poverty/app_DynamicOptDex/GlMkQm.json

Filesize
4.4MB

MD5
b9ad796a053939f6f771e02e2a0faa83

SHA1
edce9346a8f84072c539e22e18ee10b1ee7f81cc

SHA256
218279f0f5fb186dca5baa66164cbe43e75e8630643bd5bf4fd9a3483cfe1019

SHA512
9e0073665413d72978780578be61825467138d65173b3709ebd8f803a6cb36e1c49e4f4c79bd32fc54e13b6b9ceefff48f2d5d6e453b9e9ed8ccacd37282c0ed

Download Submit
/data/user/0/com.travel.poverty/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit