hydra | b8285714c61aabe540aa39221cd2dadba04a389919e554d531604d8bded2359b

Analysis

max time kernel
3107121s
max time network
150s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
03-08-2023 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8285714c61aabe540aa39221cd2dadba04a389919e554d531604d8bded2359b.apk
Size

4.1MB
MD5

0d37a9b5ae1454c3fcbf379963d38b5d
SHA1

c5315746876ce5a7f9edd9280ea426fa1b2cc8de
SHA256

b8285714c61aabe540aa39221cd2dadba04a389919e554d531604d8bded2359b
SHA512

abe10446992c4d599b366f7bf02a122f81f2fed614b16983b1d1aa6dcfc57867be5e5dd464ceed49b057bf0535c054086c332394a43fa14c74346a7e08b8d84e
SSDEEP

98304:nwsTYmUzC4rZfYdfGaCl2gzARpSOCyNx9vLrqmp:NPGjaCl2Bp5Tb9vXqmp

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4166-0.dex	family_hydra
behavioral1/memory/4100-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.such.joy
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.such.joy

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.such.joy/app_DynamicOptDex/CSUSr.json	4166	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.such.joy/app_DynamicOptDex/CSUSr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.such.joy/app_DynamicOptDex/oat/x86/CSUSr.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.such.joy/app_DynamicOptDex/CSUSr.json	4100	com.such.joy

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ip-api.com

Reads information about phone network operator.

com.such.joy
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4100
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.such.joy/app_DynamicOptDex/CSUSr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.such.joy/app_DynamicOptDex/oat/x86/CSUSr.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4166

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.such.joy/app_DynamicOptDex/CSUSr.json

Filesize
1.9MB

MD5
269818a613e8c54603408cd6cacff76c

SHA1
d13b9f625ba0a006cfbca3c313ca9a2b57eb267c

SHA256
238b95abe6597582674aa66f9383179860a5a29aac6e6d6ffe6a3ea03cfbdbbc

SHA512
ea6309c040a7318401958ffcfd8a1227fa2ad2c766f8f33fca03c0304d1b1539da11a0bb448b3028d82955bfe2181ff2005021ac4b63064721d6f5ad7047688a

Download Submit
/data/user/0/com.such.joy/app_DynamicOptDex/CSUSr.json

Filesize
5.0MB

MD5
91ee6bb319775348183eb62cbc5366ea

SHA1
ab14591b92c354dd047fa18b1126e24c62cbd053

SHA256
cd8f5c87ca02a3f24381f3bf71ccf0d69769d057c5f8abfd82612e3697cf7168

SHA512
208ca34c4a55563224f7500aa09c3d309d6ec284723114b643f2db65d5a41805ae08d01c9f0315ceb48f7215d1743ffa5d4bc54056379e5238720142dab6b39f

Download Submit
/data/user/0/com.such.joy/app_DynamicOptDex/CSUSr.json

Filesize
5.0MB

MD5
33c7c9950172a836259776101bcac096

SHA1
f5c8598a28eec0bebf7e07fc23512c89b30472d6

SHA256
dc302c0fd08473b5916fc3d26a8035df332391d9535da610c52fcb2ec48d55ef

SHA512
75b0ed13a94fabe307c48971cf13150c9c3ab9f4c4128bcb1d71519b4d2aff2221f72e7174970b468ff00b09ad9c9ac613e6de586668fc6f9ed085366b35286d

Download Submit
/data/user/0/com.such.joy/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
232dcb3563a61b3a5f9fd4a555b32d54

SHA1
9d29d0a13acc8d40f641df1bc7af530bc663dab1

SHA256
d092ef92e12ed4cd7f70ff34b1b0b83c734323f702e4d4e3d5da134d26e0ecc7

SHA512
593ff6c3992c7ef7c13c3380a1f171887537a3347c218e9e2e0d29a55358d576ae659b76079f300eb8f9afef83fe489f34f6422fd764b7ee2a76c5e04f9fe0c3

Download Submit