Overview

overview

10

Static

static

6

3154684c41...48.apk

android-9-x86

10

3154684c41...48.apk

android-10-x64

10

3154684c41...48.apk

android-11-x64

10

Analysis

  • max time kernel
    1754109s
  • max time network
    158s
  • platform
    android_x86
  • resource
    android-x86-arm-20231211-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231211-enlocale:en-usos:android-9-x86system
  • submitted
    14-12-2023 13:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3154684c4192a1ae7a00f9f61d3024e2d25a85508c512094a771f878c3130848.apk

  • Size

    8.4MB

  • MD5

    ad53ff0a6090ab4904bc589ebbf64bb0

  • SHA1

    4caa507ad88af628be9d5e53a4dcbfba34c4351e

  • SHA256

    3154684c4192a1ae7a00f9f61d3024e2d25a85508c512094a771f878c3130848

  • SHA512

    df103e1d1ba138b6a87dd4c10c9de954db2732627d32ff3cbb821ee87cbfcbbc52b3123070bd3304f6f595f064fb28b581694788191ff6ec8371e11be40067b3

  • SSDEEP

    196608:k1aEShpFlM17N317z391qgpyNP6QDWx0RiQdyjynFAL9mTO:k1ahnHM17pFz3DBp2P6cWabyj40IO

Score
10/10
hydrabankerevasioninfostealerstealthtrojan

Malware Config

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Makes use of the framework's Accessibility service 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • com.vsmucodt.bhvxnft
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4277
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/oat/x86/base.apk.hgynibx1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4310
    • /system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/com.vsmucodt.bhvxnft/app_torfiles/tor /data/user/0/com.vsmucodt.bhvxnft/app_torfiles/tor -f /data/user/0/com.vsmucodt.bhvxnft/app_torfiles/torrc __OwningControllerProcess 4277
      2⤵
        PID:4373

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.vsmucodt.bhvxnft/app_torfiles/geoip
      Filesize

      1.1MB

      MD5

      0fe6d9f9d54efa0f2bbb57549898aa38

      SHA1

      be6f0c5e1061fa39f9d1add7a0d17a4df2d83637

      SHA256

      da1680380aae03f8d9bb899771aee63d913770d051cdcdd165c9132ce98d7ec2

      SHA512

      abcfa85743e590f28dfb77155f37b21d621fe47b69288bee7d74acb86548d62a00f54cc001c2668749644d25ce45796eb8f5b957f945b214de998e5cb76b0c5c

      Download Submit

    • /data/data/com.vsmucodt.bhvxnft/app_torfiles/torrc
      Filesize

      336B

      MD5

      d7f9dc2b2dfbabda8875c0a58ad0ed8c

      SHA1

      24ffd3fc5647902447f613cfb86e7b7e473f4bd9

      SHA256

      2dd4f8bd7093ff1ff49e6da36b6753cede4ae8dc1b97a6b62551430624692768

      SHA512

      321c39254b37c7f51087d5123346f6be53ce05060ba52a7d6aa52080da92232833614498e75aa43e62c3aa33b21d90193e5f3a69ecbe60a2e0d8a52019b1aa84

      Download Submit

    • /data/data/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/tmp-base.apk.hgynibx3063922139374388146.xhg
      Filesize

      538KB

      MD5

      dc5e16107784652f5099f744c35ed328

      SHA1

      326589b22fb30cc39213ee5aa13b44d95528a60c

      SHA256

      a0f08f6b999f2f21496cfa5ee9ad32e809d6463a845177a9ba1ca47118f87081

      SHA512

      4a6080c88047254df20e473af9d231d8eb187691bcb6855ab980bd7ebc0137cf5e2064f3c7e8678b7b68292efee47af185f8a80f7d50722f2d6bed1926ea5d2c

      Download Submit

    • /data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg
      Filesize

      1.2MB

      MD5

      c75d5adb0ca0beb718c2534bde791dfa

      SHA1

      68145684528706d1bb0218f79ce8db0e71126498

      SHA256

      a17c902352d890c6235ee2162a08bc36fab2fd535b07a6de003510d07e55fed7

      SHA512

      0688265e7e508dad0189b75a23029c846f414122fdc9b4306fcacd6608ad12a27a1e50fadc41c2554e1d858f52ab5b1b7100145acf200a0dd54a971d6292768d

      Download Submit

    • /data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg
      Filesize

      1.2MB

      MD5

      dde288fb8a3b26bc1e943fe18d2407c4

      SHA1

      4095f659245eb5e149d8e3c8cbd9a9fa70854d30

      SHA256

      fa5e6db97f003fad821603e02c949b6d3c07a3c63077cb6cf1e5f92dd8c2d3d5

      SHA512

      58dc81450aff626c175128373e70a9e6b6ef6aa8c03de0b22b12971bd091fa8b4da8f3244f0f56b35beeb51a65d9802b824e57af27a2ee2634033f08f80b3c79

      Download Submit