hydra | 9490778dd7a5afd4bf14bd6d9dee3607a00567e1372f9b966137cbcf58caf01e

Resubmissions

26-06-2023 10:30

230626-mka1sahd53 7

26-06-2023 10:29

230626-mjhn8sac5s 7

12-06-2023 16:29

230612-tzc71sde6y 10

Analysis

max time kernel
2960345s
max time network
160s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
12-06-2023 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9490778dd7a5afd4bf14bd6d9dee3607a00567e1372f9b966137cbcf58caf01e.apk
Size

7.3MB
MD5

00f8ce61a92691c2be7b4823b5cfd0de
SHA1

c9c1022b744edabab8a1ce654ffc84b10ca4a832
SHA256

9490778dd7a5afd4bf14bd6d9dee3607a00567e1372f9b966137cbcf58caf01e
SHA512

c8264b75a61293fd14cc21162f9697c9dbe0269e8966a8ad5c9c142caac2b4ef9f4e1d49b28ceb8b2a040acc32fa007d651284b8c10d0f62f45fc44ad4f6ca58
SSDEEP

98304:7n4DIojOvRLPi+BUuXj+53DG7IDpuAnnOyFBMHYgnd4ymIsn/h8t8TKWRvchJAZ4:7xousuXwPpuMCY4dLvsnZBKgSXyTjcVl

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral2/memory/4806-0.dex	family_hydra
behavioral2/memory/4806-1.dex	family_hydra

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.until.corn/app_DynamicOptDex/CoqPx.json	4806	com.until.corn
/data/user/0/com.until.corn/app_DynamicOptDex/CoqPx.json	4806	com.until.corn

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	ip-api.com

Reads information about phone network operator.

com.until.corn
1⤵
- Loads dropped Dex/Jar
PID:4806

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.until.corn/app_DynamicOptDex/CoqPx.json

Filesize
5.2MB

MD5
e73abf4dc6d5c3ce5912d266b573886e

SHA1
b95e1bbf23daa2f63e54d31197caab3ab7f1b0a8

SHA256
90ea78692035e77d3632cb6b9791d2d3f84705a31a176a238fc655153b82f4aa

SHA512
322b1c560b44222541428dee5ee00c27ae18e9250ee53b7e8e214677bae04dae216d27402b38e525614f18b73900c0adf7dc94718e42b7492a978120b2354ee4

Download Submit
/data/user/0/com.until.corn/app_DynamicOptDex/CoqPx.json

Filesize
5.2MB

MD5
621d5b34e40f5f0110049d6584b4e361

SHA1
97cad93005d4000811480c31cd14a8eece1d6b61

SHA256
6a98aa2432b42a537e4479f621f765901c301f7eb0fbc16e5f055aa4bfbcce3c

SHA512
fba942cbc32c36c051e490682806226d3364c4cc77ceb50694995740f14d95b80368736a5c8d516ee43ea374aea97fb8961a75e83e4e69bdee74ed0a3afbe3c9

Download Submit
/data/user/0/com.until.corn/app_DynamicOptDex/CoqPx.json

Filesize
5.2MB

MD5
621d5b34e40f5f0110049d6584b4e361

SHA1
97cad93005d4000811480c31cd14a8eece1d6b61

SHA256
6a98aa2432b42a537e4479f621f765901c301f7eb0fbc16e5f055aa4bfbcce3c

SHA512
fba942cbc32c36c051e490682806226d3364c4cc77ceb50694995740f14d95b80368736a5c8d516ee43ea374aea97fb8961a75e83e4e69bdee74ed0a3afbe3c9

Download Submit
/data/user/0/com.until.corn/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
72b6da6237f80433a0ab95d808bbd41b

SHA1
3d33e8e9c95bcdace13b3e1ed5e33fb587d8a6c9

SHA256
c3225ec769c9ccba91fcee297cc076de0a76b8cb0953b08e1fe5c50434f1a164

SHA512
d30f9ec748b2a98b0213c2de5308ead261613cfd4b0f268032b64b2756897dafbb61ed6939610aa841dfca9a9050a14ed85e6e8e6576223d4494e4075a1f8de4

Download Submit