hydra | 646538cdfc45e8ef64816ed9faf824b52cf6b856eada0e9dd4e3fd92f702b6bb

Analysis

max time kernel
458352s
max time network
144s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
10-10-2023 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

646538cdfc45e8ef64816ed9faf824b52cf6b856eada0e9dd4e3fd92f702b6bb.apk
Size

3.1MB
MD5

1dfde650c7fcef063427d3e78e4698e9
SHA1

f711c2fa18f0ca8902eea6bee753eccce637b824
SHA256

646538cdfc45e8ef64816ed9faf824b52cf6b856eada0e9dd4e3fd92f702b6bb
SHA512

32112ba5ae9b5cc900b9506441c74620c304bcfdbeff1ec70cb4f5c57d708539f803d4540088bd68f8740e7b1aae862ac1dbb95a7bc74d117bd5b805e9275dc9
SSDEEP

98304:f4gX+t7BIe8QgUZzPKIRcfJoYxn3OD4AFfheLAne:f4gXi7BN8QgUdPfehpJ3O3fhEAne

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json	family_hydra1
/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json	family_hydra2
/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json	family_hydra1
/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json	family_hydra2

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.knock.gossip

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.knock.gossip
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.knock.gossip

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.knock.gossip/app_DynamicOptDex/oat/x86/LbM.odex --compiler-filter=quicken --class-loader-context=&com.knock.gossip

ioc	pid	process
/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json	4193	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.knock.gossip/app_DynamicOptDex/oat/x86/LbM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json	4167	com.knock.gossip

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
Reads information about phone network operator.

flow	ioc
15	ip-api.com

com.knock.gossip
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4167

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.knock.gossip/app_DynamicOptDex/oat/x86/LbM.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4193

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.knock.gossip/app_DynamicOptDex/LbM.json
Filesize
1.9MB

MD5
71bbf12cc00408a54cc34f4ffadd12f4

SHA1
42c7236e009f1405e0dc7d31ef5d4c8392032d7e

SHA256
8aba134ba5cecee7e80131ad416071283d145174817e0eaf18d7b100097805ab

SHA512
0b110e4bed1b362938643cc8a8260f8ab9a6925faef3b561250a64d7885463d3825d01d16ddcfb3dd212b30b3285bec8090b7d9367d80888e225ec6fa3146705

Download Submit
/data/data/com.knock.gossip/app_DynamicOptDex/LbM.json
Filesize
1.9MB

MD5
bfb1e01675df7636992c67bd205940f7

SHA1
35fe01dfda386094787cd68dee8c6480a569f80f

SHA256
20fde64c79e6ad996533b088b3f00a0b5f1baee95c795dbff12076200aef7270

SHA512
88cb3459579df8953a6870104b071d30089bbaafec148e186db7196d1073d43376cd01185f152ecbe8efe9c8207ccd626b111019c75e4102ea45306f4ba43cae

Download Submit
/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json
Filesize
5.0MB

MD5
91ee6bb319775348183eb62cbc5366ea

SHA1
ab14591b92c354dd047fa18b1126e24c62cbd053

SHA256
cd8f5c87ca02a3f24381f3bf71ccf0d69769d057c5f8abfd82612e3697cf7168

SHA512
208ca34c4a55563224f7500aa09c3d309d6ec284723114b643f2db65d5a41805ae08d01c9f0315ceb48f7215d1743ffa5d4bc54056379e5238720142dab6b39f

Download Submit
/data/user/0/com.knock.gossip/app_DynamicOptDex/LbM.json
Filesize
5.0MB

MD5
33c7c9950172a836259776101bcac096

SHA1
f5c8598a28eec0bebf7e07fc23512c89b30472d6

SHA256
dc302c0fd08473b5916fc3d26a8035df332391d9535da610c52fcb2ec48d55ef

SHA512
75b0ed13a94fabe307c48971cf13150c9c3ab9f4c4128bcb1d71519b4d2aff2221f72e7174970b468ff00b09ad9c9ac613e6de586668fc6f9ed085366b35286d

Download Submit