hydra | d37354a9ee083d1cc8d337cd4008231d303c763768c3fe2f443c7bb4ec184522

Resubmissions

20-12-2023 22:16

231220-16txnshbe2 10

20-12-2023 22:00

231220-1wvq8ahbb5 10

Analysis

max time kernel
2303578s
max time network
156s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
20-12-2023 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d37354a9ee083d1cc8d337cd4008231d303c763768c3fe2f443c7bb4ec184522.apk
Size

3.2MB
MD5

be81405574365c97fc0b3010cc039cad
SHA1

5a7ff7b6998ae7de9a94d4fb5af4805b6eab4fb9
SHA256

d37354a9ee083d1cc8d337cd4008231d303c763768c3fe2f443c7bb4ec184522
SHA512

9e539cc62019eab99aecf02eb29b517467e257a46392c2da69831e4cf39818938d86c50c427a5afa4de743f073d2699275ed3ca14299e2b94545011854e93bbf
SSDEEP

49152:+mZ5+Rb9KN9/QaJGiXNc9GUnDdYxU82S0lZYfvuXibOHh4K4844qkGdWGNTc:dlJGiWYeD0U870lZs2XNB4Kp4LjTc

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://cioroapapoldoapolawe.org

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 4 IoCs

Processes:

resource	yara_rule
/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json	family_hydra1
/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json	family_hydra2
/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json	family_hydra1
/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json	family_hydra2

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.doll.cross

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.doll.cross
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.doll.cross

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.doll.cross/app_DynamicOptDex/oat/x86/rmDMM.odex --compiler-filter=quicken --class-loader-context=&com.doll.cross

ioc	pid	process
/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json	4274	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.doll.cross/app_DynamicOptDex/oat/x86/rmDMM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json	4248	com.doll.cross

Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.doll.cross

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.doll.cross

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.doll.cross

com.doll.cross
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
PID:4248
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.doll.cross/app_DynamicOptDex/oat/x86/rmDMM.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4274

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.doll.cross/app_DynamicOptDex/oat/rmDMM.json.cur.prof

Filesize
629B

MD5
1395fa411d2444cc1cd104782fcc5f61

SHA1
3615432458bcc21712b430cbf07277faa40f7d1e

SHA256
8dc72750a15ee818364c637a4684929d00a20a4a0339a49b5618dfbf0be7dcc3

SHA512
73cf28e51186c682b97fc7fbb90fce776f98d16042d9c74d51cd9752d5ca123987b6a816ffba8dc27718821a309b6e310c3379ed762948e7a7242a6fd6560960

Download Submit
/data/data/com.doll.cross/app_DynamicOptDex/rmDMM.json

Filesize
1.6MB

MD5
a1dbe9b933d6f3d4cd7b98112d5e02cc

SHA1
29b2b90c77c9a8c47b0af7e76424c44129b51f7f

SHA256
234070560b50446a239795f6f850d7bb15bdc6e1bd808304627e5043c23aa289

SHA512
2c0f98bc377d2fd123391e4bd4711658b620e570721bad04e2c505ed461e44c8d8dc06be636f415581076aee0b2ce3304d2ce59f69fdd1924815a21efae9c00d

Download Submit
/data/data/com.doll.cross/app_DynamicOptDex/rmDMM.json

Filesize
1.6MB

MD5
02699b682e0aa8c1c3222a5bf56b442a

SHA1
ccacd7fff021fa43ec4c3a38fd56a04f80a6797f

SHA256
b39149ab73a76f84dddcb8fc2e2191b82a60fbef337460186264b54ab6298bfc

SHA512
5ebb9cf5e3b81810fa9dce8ce77f682009d562778f3ecc5cf1e123c42fce4c27d22b674fee5f00c5472410eb8028f45871bfbbf475e5580d4329108b18e54a7d

Download Submit
/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json

Filesize
4.4MB

MD5
13db26588243fb2cfd3db6f2f0d1c626

SHA1
c13b8c1dc75d4b65150ac5bdbe509baf919736f4

SHA256
cd34566b2a8e41730fe294711215531905c27fe3c6ae50448bba1e36e2d4792b

SHA512
a516c541c967c2b0afc97c918596966ceb89e3d61533e5d3d9f0b682c9ff2f2ad8fc4cab8ef145db2d01f99fd9f95049c6dbaf67230b612737c8fd878ec57333

Download Submit
/data/user/0/com.doll.cross/app_DynamicOptDex/rmDMM.json

Filesize
4.4MB

MD5
7eb3a44802ceef8f67ac39fa5a2fca84

SHA1
dbfdb898d194e2be0d746332def8c841341d47dc

SHA256
b491067b9dca0dbdfd07efbebbd5e683942645b5a11aaf5f2380060ec767d414

SHA512
9441bac47d0685cc19c09fe7bab34044b86bd5b52f388a5ad643428c1af4483c46c1fe9b29277c230fece2ab95ddfef4dafc99ee79e7a759c80429f1ce83ba75

Download Submit