Overview

overview

10

Static

static

7

E74C08FD6A...96.apk

android-9-x86

10

E74C08FD6A...96.apk

android-10-x64

10

E74C08FD6A...96.apk

android-11-x64

10

Analysis

  • max time kernel
    78552s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    21-03-2023 14:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    E74C08FD6AD250FA63E028CE7801ECA99A460562107CC40727B0FBCA80182196.apk

  • Size

    3.4MB

  • MD5

    b61470b9b40cc8a08b3244ae70a187f2

  • SHA1

    fb5458ab4445ca6fbc77a2197585e4f8a5af0e32

  • SHA256

    e74c08fd6ad250fa63e028ce7801eca99a460562107cc40727b0fbca80182196

  • SHA512

    678b66b4f17f8371a876579ad7e5741c2f0b673f668463a9b714d773231493fb39aaf7dd48eacf848e6483813fc557787dfa350e801605f05662e03a8da6d9f7

  • SSDEEP

    98304:2ejRZZYQi4+v4UakNXRoZq8mrw/JhjH4Ta:XnizLakoX3JyG

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Extracted

Family

hydra

C2

http://saygosesgoforesosne.net

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.flee.rail
    1⤵
    • Loads dropped Dex/Jar
    PID:4754

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.flee.rail/app_DynamicOptDex/XfOkior.json
    Filesize

    1.3MB

    MD5

    032e1a1b4b49c11d3eb7c3104a05f55d

    SHA1

    fd43fa9f1a8e00e63f147a9337691114b31334c4

    SHA256

    ec43b47a030fd2865e4a8f2524ee28c994b0e7095ce0274c9c79b39ff1b876ad

    SHA512

    f9eedd13eb7578eaa68e6aee4ee45c0d49163dadcf371a1279e1bce1562cb02383a10ba3e5dd6dc1257aeb86d1a42aff0f8ab01da652f4433798ec637093e1ee

    Download Submit

  • /data/user/0/com.flee.rail/app_DynamicOptDex/XfOkior.json
    Filesize

    3.6MB

    MD5

    7d66063b17e478007eaf7d8e13305e05

    SHA1

    bb0360fe73fa8aa8be409114e7d84fbfb09e6d99

    SHA256

    a7df9f982dbad9adce236859a1ae6c79206b27ebbd8e8730f09e9461dd595757

    SHA512

    11adefd47732d652f535aa8f58d3a2cb13586b56dc21d4ff2c686d93a6d7bf9344c8c7b89535a3eb78506c2f86676c1f7cf79b6f8083caa410b383384e43a3ae

    Download Submit

  • /data/user/0/com.flee.rail/shared_prefs/pref_name_setting.xml
    Filesize

    131B

    MD5

    609812f5dea6a63722724837133ca8bc

    SHA1

    81e134cd1acee2bf0df4f722ca76c2a9bbcca5a5

    SHA256

    a6c71a7d8e66bb7b2d56396b8f4bbd8c99bb4ee84b73735942d449db3cbea91f

    SHA512

    f3615a938cfb827d74e79d81dab858aa39428857ce40e4951625144d88770091df91c7e246347ad1023bd8f542dfa5e9f53981b2d7a13f671057b4bb4a98dd52

    Download Submit