hydra | b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e

Analysis

max time kernel
3518857s
max time network
159s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
07-08-2023 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e.apk
Size

1.2MB
MD5

cf050524e311430413cf6e4f5bf4fd80
SHA1

bfdd6b22fd8c0a418212e4d1fc4c3009c55d070f
SHA256

b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e
SHA512

bbe5b0f0c572205f59071a53532a24b50d236b14aca7c0a8e76b75cfa2f1ded6764e376ed1138651bf6b9cf3d6e89399d6848084cc8135c9db3a37ca8bdd082e
SSDEEP

24576:ykkkrRUhjjjiXC5p4RsRbfPJkxq5vKVMHzlnhJV3YY/DNXl:BRAjOCPRb3JkivKVIlnhJV3Fl

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://lanagarza441.lol

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4151-0.dex	family_hydra
behavioral1/memory/4087-0.dex	family_hydra

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.excite.vacuum
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.excite.vacuum

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.excite.vacuum/app_DynamicOptDex/yuUS.json	4151	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.excite.vacuum/app_DynamicOptDex/yuUS.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.excite.vacuum/app_DynamicOptDex/oat/x86/yuUS.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.excite.vacuum/app_DynamicOptDex/yuUS.json	4087	com.excite.vacuum

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ip-api.com

Reads information about phone network operator.

com.excite.vacuum
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4087
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.excite.vacuum/app_DynamicOptDex/yuUS.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.excite.vacuum/app_DynamicOptDex/oat/x86/yuUS.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4151

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.excite.vacuum/app_DynamicOptDex/yuUS.json

Filesize
239KB

MD5
6db6360030535dbe7a25ec31f8d52e63

SHA1
7ca25dc4af543a29741dc609bb3486237be705e2

SHA256
bafd568eec04acdc89bb01ec6dd1dba0ca484487caa4b4f6c6aa80307d2483d0

SHA512
e5762d9f170d14b9391ef9881a13a402eba50de18e296e5010fd1b98634ba6944ea1066b5d4fbc2ef5499a067945cb2188962ebed1b600dea5e1deea909c133f

Download Submit
/data/user/0/com.excite.vacuum/app_DynamicOptDex/yuUS.json

Filesize
574KB

MD5
4ad15c001da7b3afd0041c46eacfc52a

SHA1
dda66388bbd27cccb866da232e1f52bd1f446f60

SHA256
130494ce284543836efbaebdc90a50feec584fa5ed0b8a82d53a2555511258b8

SHA512
d8cd1e59922c2404f3aff2170cb7aac35ef3349cddae745a7227ccc4eba398659e171107d3c3cd0910bde3d2e5aa1ba17281ee4c75ce8fe6c21f92fde94b8679

Download Submit
/data/user/0/com.excite.vacuum/app_DynamicOptDex/yuUS.json

Filesize
574KB

MD5
291a7fd599d7c94b8fb85a58b2326c79

SHA1
76c8563b0aab60d1333a836b4e7168bc243479b2

SHA256
18be2e790a556f4bd49aad5abcb389fde7eeb2d6ebbd523f3a42b33c4adfe29f

SHA512
c93464a8fd4104205ed94004520954ad706c8125463782d4e34a34d95146b4501b292a62a5df06c8e07d92de70914693c9c6747a3d52368bcacd34c301d215bb

Download Submit
/data/user/0/com.excite.vacuum/shared_prefs/pref_name_setting.xml

Filesize
131B

MD5
5dd8ddfaaef6c655303c0bd015a5314b

SHA1
513e8f9b96a24458241b9c36677d3a6287ac8537

SHA256
7f47240220d73f9914293b1928a888269030f13f24f1a91e0d2617d557d50f82

SHA512
4f544c7b0fdee1ed1dbeb91f1a47df037a48168438cb4358aa9083147b0a0fc71a86f84f74019c984f26adf63ffafc91ce405d6e94b9a5bedbc15eaaaafc5b27

Download Submit