hydra | 58feca1b4b8c19b000d7911e2586659d65d8add75d96c3611530afc3cf11f841

Analysis

max time kernel
73480s
max time network
152s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
28-06-2023 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58feca1b4b8c19b000d7911e2586659d65d8add75d96c3611530afc3cf11f841.apk
Size

1.8MB
MD5

a2afdca2093a9a2de5b2b678ce50184e
SHA1

6d952d50d676c03c2d9f8ffb962bdb9f13179a6f
SHA256

58feca1b4b8c19b000d7911e2586659d65d8add75d96c3611530afc3cf11f841
SHA512

d19fd5128a6af238cfd22adaeabbb4e869153c1c42e5266a12ea81e4869007c5f848f0dcd434289a80b693a6b6cacf4cdeda1812bdd0d1cb31466fcaf3dd8f06
SSDEEP

49152:p5tLHOuG8mWsyLoA3C50utRd+8nZ3yb8Yz7YU7RNHFoIrEjyK:tOuu150Ud+8sb8Y/YU7R/o0EjT

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://yolderyasibizdenizgez.net

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4173-0.dex	family_hydra
behavioral1/memory/4081-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.night.mail
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.night.mail

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.night.mail/app_DynamicOptDex/xJDBZ.json	4173	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.night.mail/app_DynamicOptDex/xJDBZ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.night.mail/app_DynamicOptDex/oat/x86/xJDBZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.night.mail/app_DynamicOptDex/xJDBZ.json	4081	com.night.mail

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	ip-api.com

Reads information about phone network operator.

com.night.mail
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4081
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.night.mail/app_DynamicOptDex/xJDBZ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.night.mail/app_DynamicOptDex/oat/x86/xJDBZ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4173

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.night.mail/app_DynamicOptDex/xJDBZ.json

Filesize
972KB

MD5
2f509df128ce2270729dabe58f5df516

SHA1
32cdc29e097df2a82e4d84b1fa1c810a0c47ac9d

SHA256
4fee231bc201cd123235f4d30e0c9d88e4bff50408cff3a8ab86abbb1b5ca7a8

SHA512
d67950e8f62d5c9bf604b091f42cfbbb30aa32a3b31e1bd636318cce32a1b71b14461b1708021dc6cbbae4714f5d0f6c63d267b5870132369a4090b6dcde0ed7

Download Submit
/data/user/0/com.night.mail/app_DynamicOptDex/xJDBZ.json

Filesize
2.2MB

MD5
7288f7ad01e4ab11e34bd8172a384bdc

SHA1
91a7e0a2f96a8ebc14b04a8282b03e7a0452f38f

SHA256
f294285272458676c6ae3fc5cc2299812da31b5b86f20d01667984f77616a01a

SHA512
63d12fee3143085c5f02c943e3de8887dfcb9c67fe51e20dc2638df92aee1c48056a3f572a4745a5b7f98ef1b13dff351b027a2d37b23ace97c92feeb0bb9468

Download Submit
/data/user/0/com.night.mail/app_DynamicOptDex/xJDBZ.json

Filesize
2.2MB

MD5
f186d37bc3df8c2dfb8f0fb57a7e5ded

SHA1
c33c48c47ccbc865d21020b070f26562234d2c19

SHA256
7e548c7b93c26d4d6bf8b31ce76c6c14d9c3f91e69b307807c6b1234e55047ca

SHA512
b8b5db6a85a69438387fbe790aa8cef640397a09a322ab3af037cca32cce00973ff7a0d74bf4cb2242987d28cbbe41de2d0d69481da03551334656446ca36a36

Download Submit
/data/user/0/com.night.mail/app_apk/payload.apk

Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit