hydra | 390baefed293313a4d6fdb37fe774090249455011e5fe82f44afca467f62881e

Analysis

max time kernel
588043s
max time network
144s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
11-10-2023 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

390baefed293313a4d6fdb37fe774090249455011e5fe82f44afca467f62881e.apk
Size

3.3MB
MD5

f8b60a66343ad882cb1cfece12e5b94e
SHA1

0e17700551d094a8c6c1fedc6d1f114fa5ace804
SHA256

390baefed293313a4d6fdb37fe774090249455011e5fe82f44afca467f62881e
SHA512

379fd7f886b789ad32f2e3989c2f9421099dcf5db0b977c6196680da61cab291ff6635b537a5a3f902877baf0bf7da7f84a9ea4ba088879431b8276d91a0d85e
SSDEEP

98304:Smj38THkGH+he0YwzMlmW1yM/th0MyIEZWbPQqx:R87kGebYwzMUAV/T0My1ZWD3x

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json	family_hydra1
/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json	family_hydra2
/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json	family_hydra1
/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json	family_hydra2

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.glad.word

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.glad.word
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.glad.word

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.glad.word/app_DynamicOptDex/oat/x86/GWHMtIa.odex --compiler-filter=quicken --class-loader-context=&com.glad.word

ioc	pid	process
/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json	4185	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.glad.word/app_DynamicOptDex/oat/x86/GWHMtIa.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json	4158	com.glad.word

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
Reads information about phone network operator.

flow	ioc
15	ip-api.com

com.glad.word
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4158
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.glad.word/app_DynamicOptDex/oat/x86/GWHMtIa.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4185

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.glad.word/app_DynamicOptDex/GWHMtIa.json

Filesize
1.9MB

MD5
b91c5947c02acaaec25a8ad1d9dd9ceb

SHA1
aabe47c378c2494530a4f052925fd36db569a082

SHA256
4fbf723701a167114afa782a78078e108175af7eeac7b63aaeea2129eb3232e0

SHA512
7bc49c0c43b39197c70c5b1405b8a682b29b61cc1d1effbd65a807797914d4ece7e454b550e63df4f31b037ca4d2728a39fb105ff06717f6ccd1035dc6e27b03

Download Submit
/data/data/com.glad.word/app_DynamicOptDex/GWHMtIa.json

Filesize
1.9MB

MD5
1c0df5829844fd96e982249581eeb1f8

SHA1
bba71fecba984a32ca8a98293ea818377cd54990

SHA256
dbf3455a92dd10a27aeb007054e90f0ae9852d89c240ef402e760ad3d228a5a2

SHA512
d214993c7354ed08d74ce360c0df4839f2099bf2dbcca649b1f1527d8850c8cacd4fff8cef5477cb6850975b470a86c685251441307f1290bbe57f7987f6da9a

Download Submit
/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json

Filesize
5.0MB

MD5
91ee6bb319775348183eb62cbc5366ea

SHA1
ab14591b92c354dd047fa18b1126e24c62cbd053

SHA256
cd8f5c87ca02a3f24381f3bf71ccf0d69769d057c5f8abfd82612e3697cf7168

SHA512
208ca34c4a55563224f7500aa09c3d309d6ec284723114b643f2db65d5a41805ae08d01c9f0315ceb48f7215d1743ffa5d4bc54056379e5238720142dab6b39f

Download Submit
/data/user/0/com.glad.word/app_DynamicOptDex/GWHMtIa.json

Filesize
5.0MB

MD5
33c7c9950172a836259776101bcac096

SHA1
f5c8598a28eec0bebf7e07fc23512c89b30472d6

SHA256
dc302c0fd08473b5916fc3d26a8035df332391d9535da610c52fcb2ec48d55ef

SHA512
75b0ed13a94fabe307c48971cf13150c9c3ab9f4c4128bcb1d71519b4d2aff2221f72e7174970b468ff00b09ad9c9ac613e6de586668fc6f9ed085366b35286d

Download Submit