Overview

overview

10

Static

static

7

b8285714c6...9b.apk

android-9-x86

10

b8285714c6...9b.apk

android-10-x64

10

b8285714c6...9b.apk

android-11-x64

10

disney.js

windows7-x64

1

disney.js

windows10-2004-x64

1

googlephoto.js

windows7-x64

1

googlephoto.js

windows10-2004-x64

1

hbomax.js

windows7-x64

1

hbomax.js

windows10-2004-x64

1

netflix.js

windows7-x64

1

netflix.js

windows10-2004-x64

1

web.js

windows7-x64

1

web.js

windows10-2004-x64

1

Analysis

  • max time kernel
    3107013s
  • max time network
    168s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230621-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230621-enlocale:en-usos:android-11-x64system
  • submitted
    03-08-2023 02:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b8285714c61aabe540aa39221cd2dadba04a389919e554d531604d8bded2359b.apk

  • Size

    4.1MB

  • MD5

    0d37a9b5ae1454c3fcbf379963d38b5d

  • SHA1

    c5315746876ce5a7f9edd9280ea426fa1b2cc8de

  • SHA256

    b8285714c61aabe540aa39221cd2dadba04a389919e554d531604d8bded2359b

  • SHA512

    abe10446992c4d599b366f7bf02a122f81f2fed614b16983b1d1aa6dcfc57867be5e5dd464ceed49b057bf0535c054086c332394a43fa14c74346a7e08b8d84e

  • SSDEEP

    98304:nwsTYmUzC4rZfYdfGaCl2gzARpSOCyNx9vLrqmp:NPGjaCl2Bp5Tb9vXqmp

Score
10/10
hydrabankerinfostealertrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 1 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

Processes

  • com.such.joy
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    PID:4488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.such.joy/app_DynamicOptDex/CSUSr.json
    Filesize

    1.9MB

    MD5

    269818a613e8c54603408cd6cacff76c

    SHA1

    d13b9f625ba0a006cfbca3c313ca9a2b57eb267c

    SHA256

    238b95abe6597582674aa66f9383179860a5a29aac6e6d6ffe6a3ea03cfbdbbc

    SHA512

    ea6309c040a7318401958ffcfd8a1227fa2ad2c766f8f33fca03c0304d1b1539da11a0bb448b3028d82955bfe2181ff2005021ac4b63064721d6f5ad7047688a

    Download Submit

  • /data/user/0/com.such.joy/app_DynamicOptDex/CSUSr.json
    Filesize

    5.0MB

    MD5

    33c7c9950172a836259776101bcac096

    SHA1

    f5c8598a28eec0bebf7e07fc23512c89b30472d6

    SHA256

    dc302c0fd08473b5916fc3d26a8035df332391d9535da610c52fcb2ec48d55ef

    SHA512

    75b0ed13a94fabe307c48971cf13150c9c3ab9f4c4128bcb1d71519b4d2aff2221f72e7174970b468ff00b09ad9c9ac613e6de586668fc6f9ed085366b35286d

    Download Submit

  • /data/user/0/com.such.joy/shared_prefs/pref_name_setting.xml
    Filesize

    131B

    MD5

    7d071fc1b842591bf872ae90bfa6e83c

    SHA1

    694e853d2e98fefd903aee418c03751349aaf96c

    SHA256

    559ee2c759bd88d56b001f7a73a423c35b468bebe2399d2deb725fa507afbcb5

    SHA512

    a75ee2958ee7af7a593cf330db20315a6dc1adcbbd6e11518f04bd431ed601240f4074b772e2d5c225352a4c240b731b8a6264018be61cf6f42ee566bedddab9

    Download Submit