Overview

overview

10

Static

static

7

33c0433f45...10.apk

android-9-x86

10

33c0433f45...10.apk

android-10-x64

10

33c0433f45...10.apk

android-11-x64

10

Analysis

  • max time kernel
    4271110s
  • max time network
    118s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    20-03-2023 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    33c0433f45db19af9273a3be535bfc8901499eaf6771bbf68d146e50315a0910.apk

  • Size

    3.0MB

  • MD5

    7b63a73cedf7b0bc91e1ef383025317f

  • SHA1

    2586791ff2d25166ad739dc31c08c49769bcda0b

  • SHA256

    33c0433f45db19af9273a3be535bfc8901499eaf6771bbf68d146e50315a0910

  • SHA512

    c7dfdb5d4110ac3e435d76d256f0be6dee62a49b075eb1033384a7aee9b3fa845494d3ba37947f26231fe498de410afb0f093da141e16f58a865ad7bfa30fdb9

  • SSDEEP

    98304:sZA3SwZbvscL5gGB8wqGVdwDDguRal/WL3++tIcM3:LgcSGB8LmwXjol/mO+tIcM3

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

http://taewcfas2s.com.de

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.travel.poverty
    1⤵
    • Loads dropped Dex/Jar
    PID:4833

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.travel.poverty/app_DynamicOptDex/GlMkQm.json
    Filesize

    1.6MB

    MD5

    b0b936b8bfa5dd462fd0515ad300e0fb

    SHA1

    50cae55b4128883af6b863447ca471bddd620ee9

    SHA256

    aea2d319c200c6652b6061c7902e0fc229737d1864440a4bb8c2227144906657

    SHA512

    6a0595a3c3a21d251eb186e67c5eb9479bc576ef4340fff59017d448c94c787701712e47f9f1764a3a03b0734b6b3689154d63a3ea9688fe7d3f6a6c27c94208

    Download Submit

  • /data/user/0/com.travel.poverty/app_DynamicOptDex/GlMkQm.json
    Filesize

    4.4MB

    MD5

    b9ad796a053939f6f771e02e2a0faa83

    SHA1

    edce9346a8f84072c539e22e18ee10b1ee7f81cc

    SHA256

    218279f0f5fb186dca5baa66164cbe43e75e8630643bd5bf4fd9a3483cfe1019

    SHA512

    9e0073665413d72978780578be61825467138d65173b3709ebd8f803a6cb36e1c49e4f4c79bd32fc54e13b6b9ceefff48f2d5d6e453b9e9ed8ccacd37282c0ed

    Download Submit

  • /data/user/0/com.travel.poverty/app_apk/payload.apk
    Filesize

    974KB

    MD5

    3baeaa766ea7f31a9147208efd957c75

    SHA1

    c701de3d0e55425394ccbf8e0967639e86f3c54e

    SHA256

    75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

    SHA512

    9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

    Download Submit