hydra | c41eb0c8ad6b311a8eabd431fecbfc3ff578514189c5a75d65604316546cb368

Analysis

max time kernel
1068168s
max time network
146s
platform
android_x64
resource
android-x64-20230831-en
resource tags

androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
submitted
17-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c41eb0c8ad6b311a8eabd431fecbfc3ff578514189c5a75d65604316546cb368.apk
Size

3.0MB
MD5

bc34c1b3599c5d369491c763c9c4813a
SHA1

d21f63841d0a8827bb8f40d8e6cfddeb50ba6086
SHA256

c41eb0c8ad6b311a8eabd431fecbfc3ff578514189c5a75d65604316546cb368
SHA512

1815ce8a2423d4cdd4982392f3de8b75e3dae75b7e9d682368db7227f5f29da70c0a24fdc878fc02761e621e6f7e744f4f65d26450ae86bb0bae6eafc3a82c70
SSDEEP

49152:T8krsWTxBtwrjxS+LxIvKwwc5gsvL0m2zcTqSYi0J0801E/HnNAiPcl1dIpkJjRd:45VxxPJsT0m9qSYVNASMX1wEjH

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://wandawolmentokez.com

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.exhaust.shed/app_DynamicOptDex/kGp.json	family_hydra1
/data/user/0/com.exhaust.shed/app_DynamicOptDex/kGp.json	family_hydra2

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.exhaust.shed

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.exhaust.shed
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.exhaust.shed

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.exhaust.shed

ioc pid process

/data/user/0/com.exhaust.shed/app_DynamicOptDex/kGp.json 5045 com.exhaust.shed
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ip-api.com
Reads information about phone network operator.

ioc	pid	process
/data/user/0/com.exhaust.shed/app_DynamicOptDex/kGp.json	5045	com.exhaust.shed

flow	ioc
12	ip-api.com

com.exhaust.shed
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5045

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.exhaust.shed/app_DynamicOptDex/kGp.json

Filesize
973KB

MD5
0ff317d630a8537c52aff1d7c8c41242

SHA1
72e5447e409509732e60229cf1939d156e879f6f

SHA256
1dbce6b9fac5b443a59c9c03d31dde3a34319d9b77b76db2b7f509d4a95a2c74

SHA512
e5179bcafa57d60a6d26db5235f2b085e17179d1cbc7b27e87a9f3971af734b1c3d7df5e0701031804d876d9445c7f4afbdf9c39a0c45b837c0c1475fd1421bb

Download Submit
/data/data/com.exhaust.shed/app_DynamicOptDex/kGp.json

Filesize
973KB

MD5
bc30d59661045c0900729d7054aa1522

SHA1
24524b50319c59b22b3373de021c3b9493543498

SHA256
d26a5574dd9239f27196f163d272bcbd2611f6fec6cf05f48fdc58e5916ea8aa

SHA512
9d30f8e0e8018d8912076dd1cb84a205753b280c915e7ca6321c738961e4582d880c3aa7a0013a448ea227d6c7e0e25d94e058af0c0f994ffc0e8d509f6b19ff

Download Submit
/data/data/com.exhaust.shed/app_DynamicOptDex/oat/kGp.json.cur.prof

Filesize
1KB

MD5
8adfbaa5f720ce0373d5604940f8dcbb

SHA1
82dae1cf7b3d01fd896214e291bf4b07aeb15d1b

SHA256
cc863aece349428437e69dbf6dcb90d475857a1667a80e938d48e834eb552f63

SHA512
b48175f9b5e4742dcf4526798bd7c4ea3078cdc3c132a0c4d823462ab9355c3c95e4a3614964dc0f1aa74070046731a698e72f667b66b154b7ae92a3d7727892

Download Submit
/data/user/0/com.exhaust.shed/app_DynamicOptDex/kGp.json

Filesize
2.2MB

MD5
481a5e28db38dfa53ff9c07fe433e1a8

SHA1
71a7e81b6abdc8813dbbd2009106cc70325db4c1

SHA256
266ce8f9574d517f9726134c8b4f748699def03c85a414e38a247e369334eb56

SHA512
9e248eada176f3ab7a56539ed3c7d8b0cac57b95cec88051fc702cdc17af1f86799e5300f341f8f6b621a7d7706bc98d3fb3052ed34b645eac2e5be87db7224e

Download Submit