hydra | b59d43079747f8f280d0f2080cbee060e9fb7d3e0ccdd2882f6f5ffcac350efc

Analysis

max time kernel
1091954s
max time network
159s
platform
android_x64
resource
android-x64-20230831-en
resource tags

androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
submitted
13-10-2023 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b59d43079747f8f280d0f2080cbee060e9fb7d3e0ccdd2882f6f5ffcac350efc.apk
Size

3.2MB
MD5

28e8e9410267495b26dac4e384d7d738
SHA1

35e4c10b45c3354a32cd8e57bf1884e06a42988b
SHA256

b59d43079747f8f280d0f2080cbee060e9fb7d3e0ccdd2882f6f5ffcac350efc
SHA512

073140a03ee40e9589a40c0c9fff205c60e9aef333989ddda01aa43bf1e6cb708e756a00edc8ccd2b6fb9d247d17f0763c1603ff4b46226d0cf4c45e583a4c99
SSDEEP

98304:WeBihQKs25/JKqFA3jA0VQMULcIyEJmdzFTUFqdtCryR:XZkKqF6A0VQ7JyEJGzmqvCGR

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://polkamoturnos.com

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.virus.medal/app_DynamicOptDex/rFaq.json	family_hydra1
/data/user/0/com.virus.medal/app_DynamicOptDex/rFaq.json	family_hydra2

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.virus.medal

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.virus.medal
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.virus.medal

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.virus.medal

ioc pid process

/data/user/0/com.virus.medal/app_DynamicOptDex/rFaq.json 4875 com.virus.medal
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

54 ip-api.com
56 ip-api.com
Reads information about phone network operator.

ioc	pid	process
/data/user/0/com.virus.medal/app_DynamicOptDex/rFaq.json	4875	com.virus.medal

flow	ioc
54	ip-api.com
56	ip-api.com

com.virus.medal
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:4875

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.virus.medal/app_DynamicOptDex/oat/rFaq.json.cur.prof

Filesize
1KB

MD5
c2f8f93ab99d65f8d1cdb4ac5369626e

SHA1
d738a9142878e34987a797663b896cfc770d258a

SHA256
fafb4fe83d2ee8b3a0ae4c4175c3b9f91a5133d3b69b5db05069226eed0f5f7a

SHA512
b5811d1c450a6ed8d5597fbe878e1857cd77948bfccca0c5b2924e266e0f8ccebd6e67da2cb2b6a1ee548f0b7216d1d21d9e8a864e130f2bb610ead08a844eda

Download Submit
/data/data/com.virus.medal/app_DynamicOptDex/rFaq.json

Filesize
1.3MB

MD5
0a2754a0222186176cc7093cd5ca13da

SHA1
325223f01d6ce06092a87b44dc4a5ce32fe09226

SHA256
e58e8fad7b8904f7e950ee3b0577a93fd0bc25c5a7974d823dd9a468ed057120

SHA512
0467e4389e67283c4389e5b04b35a2c29910b27a41b3c97bdc463614b71d809d3bfdf2259b2c6bdb5cbf6ff61b3e86e5435847a2db60d9c7af12384071c82800

Download Submit
/data/data/com.virus.medal/app_DynamicOptDex/rFaq.json

Filesize
1.3MB

MD5
6f8d0c43ba928b1362a744b37322c4ed

SHA1
8ce9cff444a2a394939c71c0f2d98743a57a104e

SHA256
f6a4e0a1eaee870d7224f7d9455dd4775d3ef6a65eb63d0b4261c3bc785e4329

SHA512
c64ceefaab1af30716bebc4ed00a8b3af69d7f9f0d3e83f224565d1ed1737b153eb9b088171799bdafe7735bba186fd53ff11669c45c9297639b3e7a90990523

Download Submit
/data/user/0/com.virus.medal/app_DynamicOptDex/rFaq.json

Filesize
3.6MB

MD5
117cdf3d73499a5cda6d1f361b37712f

SHA1
c45bd1aaae9da1bc6e064eb83a95e99196f827ed

SHA256
a65a79a43f77cb8ce44d674b0285012f059c41501825f881e8ddc53f4d47268a

SHA512
572549870c72fad3cd88f08dd9602ba265213ec11119a4d5e1c86da2e3c6dc1b66fc893496f5a936356e380016c52cdb0d1f7eb5933e8793a98450aa587d37ec

Download Submit