hydra | cd3ff09b5070985a0797738743b1c62233918666b888dc4867cec9aa82cc5505

Analysis

max time kernel
1845192s
max time network
140s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
19-07-2023 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8319695f2a7a4c2f6050d922dd1760a5e8731064.apk
Size

3.2MB
MD5

e8e83c7e5094b7510e0a738a7fbafd6c
SHA1

8319695f2a7a4c2f6050d922dd1760a5e8731064
SHA256

cd3ff09b5070985a0797738743b1c62233918666b888dc4867cec9aa82cc5505
SHA512

8d4630f89b6e5ed1211d4caff57ef01570860c0b42db1365487e6ec8c86236d756624f9d4a5e924b5558b3134e64a89385705a31ce4dea8f53cc69bd0c616e9b
SSDEEP

98304:ZOh9u96MP1iXw8oHjEdQP6H5XJlNeG+tyD9toGhTWbBGZbRUIb3tgEjk:ZOhQ1qqmlD20Z1hDtdg

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://91.215.85.203

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json	family_hydra
/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.camp.make

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.camp.make
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.camp.make

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.camp.make/app_DynamicOptDex/oat/x86/UtumQ.odex --compiler-filter=quicken --class-loader-context=&com.camp.make

ioc	pid	process
/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json	4151	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.camp.make/app_DynamicOptDex/oat/x86/UtumQ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json	4087	com.camp.make

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

38 ip-api.com
Reads information about phone network operator.

flow	ioc
38	ip-api.com

com.camp.make
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4087

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.camp.make/app_DynamicOptDex/oat/x86/UtumQ.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4151

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json
Filesize
973KB

MD5
0e998c089232c1696b2cb09ffa288c73

SHA1
15933c3c68f27851b7653d98448c2690d547d89f

SHA256
9d6d36afd649eae6ef499f235335cdd1d765ed7adf2a3fd32e1ecce2a3ff6e2a

SHA512
aae8c5ec6f6c8c894a870886471731dd6a841a4bfeeb6b2e67fa801150c73b52ce278f5c87fd80363a141173122ce320ad6ef19a05aed10e06b445b0fc732071

Download Submit
/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json
Filesize
2.2MB

MD5
8d92c55c06525b061628fe885e184fed

SHA1
175c443b9b597aab42b472293317653b730e233c

SHA256
52519eed74493729899abeab1bc6bc106d9543e2b2a1552b909494ce12e32338

SHA512
c7c0a3779b19cf583461d1068473b30b1850ff6022f37293e0f546dac796bd0d3c9236e99fcd08263d388a4ba2d8f96c82ac37a40280c06458460350ef60250b

Download Submit
/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json
Filesize
2.2MB

MD5
f9678f76ba4f3ec181a6108a81a0adb6

SHA1
af840ad30c50671085a7c692d449ccf41eeaaa49

SHA256
91492ad501be4adc17742f00b91e71e28c26d734a0d6fe029febdca3d8af2780

SHA512
6d32d18a008fca4ca73e793cacfb9e16bc8cd80dc83d3f43f736f9e49fe6e8512d7513b58a06f7947cea3af88b8cfa9d60734038aca7c90157bd420138e13dd4

Download Submit
/data/user/0/com.camp.make/app_DynamicOptDex/UtumQ.json.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.camp.make/app_DynamicOptDex/oat/UtumQ.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.camp.make/app_DynamicOptDex/oat/x86/UtumQ.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.camp.make/app_DynamicOptDex/oat/x86/UtumQ.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.camp.make/app_apk/payload.apk
Filesize
974KB

MD5
3baeaa766ea7f31a9147208efd957c75

SHA1
c701de3d0e55425394ccbf8e0967639e86f3c54e

SHA256
75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

SHA512
9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

Download Submit