hydra | 9490778dd7a5afd4bf14bd6d9dee3607a00567e1372f9b966137cbcf58caf01e

Resubmissions

26-06-2023 10:30

230626-mka1sahd53 7

26-06-2023 10:29

230626-mjhn8sac5s 7

12-06-2023 16:29

230612-tzc71sde6y 10

Analysis

max time kernel
2960351s
max time network
165s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
12-06-2023 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9490778dd7a5afd4bf14bd6d9dee3607a00567e1372f9b966137cbcf58caf01e.apk
Size

7.3MB
MD5

00f8ce61a92691c2be7b4823b5cfd0de
SHA1

c9c1022b744edabab8a1ce654ffc84b10ca4a832
SHA256

9490778dd7a5afd4bf14bd6d9dee3607a00567e1372f9b966137cbcf58caf01e
SHA512

c8264b75a61293fd14cc21162f9697c9dbe0269e8966a8ad5c9c142caac2b4ef9f4e1d49b28ceb8b2a040acc32fa007d651284b8c10d0f62f45fc44ad4f6ca58
SSDEEP

98304:7n4DIojOvRLPi+BUuXj+53DG7IDpuAnnOyFBMHYgnd4ymIsn/h8t8TKWRvchJAZ4:7xousuXwPpuMCY4dLvsnZBKgSXyTjcVl

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral3/memory/4566-0.dex	family_hydra
behavioral3/memory/4566-1.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.until.corn
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.until.corn

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.until.corn/app_DynamicOptDex/CoqPx.json	4566	com.until.corn
/data/user/0/com.until.corn/app_DynamicOptDex/CoqPx.json	4566	com.until.corn

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
69	ip-api.com

Reads information about phone network operator.

com.until.corn
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4566

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.until.corn/app_DynamicOptDex/CoqPx.json

Filesize
5.2MB

MD5
e73abf4dc6d5c3ce5912d266b573886e

SHA1
b95e1bbf23daa2f63e54d31197caab3ab7f1b0a8

SHA256
90ea78692035e77d3632cb6b9791d2d3f84705a31a176a238fc655153b82f4aa

SHA512
322b1c560b44222541428dee5ee00c27ae18e9250ee53b7e8e214677bae04dae216d27402b38e525614f18b73900c0adf7dc94718e42b7492a978120b2354ee4

Download Submit
/data/user/0/com.until.corn/app_DynamicOptDex/CoqPx.json

Filesize
5.2MB

MD5
621d5b34e40f5f0110049d6584b4e361

SHA1
97cad93005d4000811480c31cd14a8eece1d6b61

SHA256
6a98aa2432b42a537e4479f621f765901c301f7eb0fbc16e5f055aa4bfbcce3c

SHA512
fba942cbc32c36c051e490682806226d3364c4cc77ceb50694995740f14d95b80368736a5c8d516ee43ea374aea97fb8961a75e83e4e69bdee74ed0a3afbe3c9

Download Submit
/data/user/0/com.until.corn/app_DynamicOptDex/CoqPx.json

Filesize
5.2MB

MD5
621d5b34e40f5f0110049d6584b4e361

SHA1
97cad93005d4000811480c31cd14a8eece1d6b61

SHA256
6a98aa2432b42a537e4479f621f765901c301f7eb0fbc16e5f055aa4bfbcce3c

SHA512
fba942cbc32c36c051e490682806226d3364c4cc77ceb50694995740f14d95b80368736a5c8d516ee43ea374aea97fb8961a75e83e4e69bdee74ed0a3afbe3c9

Download Submit
/data/user/0/com.until.corn/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
4fa23564deff59ed78bd320c41a2bb1b

SHA1
3f7d10c1c81607391e8730c014f384ab15c053a5

SHA256
f348799caf26674bcbea0369b40e3edefce9c512ff72234f8c898ce6bdc4a957

SHA512
2fd60758c21fd8e65f459afa68ff51632df317f548c93cdabc7fe767e708e569e293e177f276e97286d7e28ceb530cde532874509c08dbe574807f2b350a125e

Download Submit