hydra | e74c08fd6ad250fa63e028ce7801eca99a460562107cc40727b0fbca80182196

Analysis

max time kernel
78552s
max time network
160s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
21/03/2023, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
E74C08FD6AD250FA63E028CE7801ECA99A460562107CC40727B0FBCA80182196.apk
Size 3.4MB
Sample230321-sbcqxadf4w
SHA256 e74c08fd6ad250fa63e028ce7801eca99a460562107cc40727b0fbca80182196
MD5 b61470b9b40cc8a08b3244ae70a187f2
SHA1 fb5458ab4445ca6fbc77a2197585e4f8a5af0e32
SHA512 678b66b4f17f8371a876579ad7e5741c2f0b673f668463a9b714d773231493fb39aaf7dd48eacf848e6483813fc557787dfa350e801605f05662e03a8da6d9f7
SSDEEP 98304:2ejRZZYQi4+v4UakNXRoZq8mrw/JhjH4Ta:XnizLakoX3JyG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://saygosesgoforesosne.net

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral2/memory/4754-0.dex	family_hydra

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.flee.rail/app_DynamicOptDex/XfOkior.json	4754	com.flee.rail

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	ip-api.com
46	ip-api.com

Reads information about phone network operator.

com.flee.rail
1⤵
- Loads dropped Dex/Jar
PID:4754

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

XfOkior.json

Path /data/user/0/com.flee.rail/app_DynamicOptDex/XfOkior.json
Size 1.3MB
SHA256 ec43b47a030fd2865e4a8f2524ee28c994b0e7095ce0274c9c79b39ff1b876ad
MD5 032e1a1b4b49c11d3eb7c3104a05f55d
SHA1 fd43fa9f1a8e00e63f147a9337691114b31334c4
SHA512 f9eedd13eb7578eaa68e6aee4ee45c0d49163dadcf371a1279e1bce1562cb02383a10ba3e5dd6dc1257aeb86d1a42aff0f8ab01da652f4433798ec637093e1ee
SSDEEP 24576:3PpSgSkUqvcwd6cWNVKFG69sqyRBNG8hlsznZ6/1W4XGhswzPGRA+WaXl:BSgLRJRkVNm7yRBw8bsDw/1LGyQPGRAw
MD5 SHA1 SHA512 SSDEEP

Submit Download