hydra | 80c29357f8b7bd6cbd578a2425d5af03fa97845e50f261073c85b1cd71c2a2ba

Analysis

max time kernel
2428778s
max time network
130s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
20/12/2023, 03:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

80c29357f8b7bd6cbd578a2425d5af03fa97845e50f261073c85b1cd71c2a2ba.apk
Size

1.9MB
MD5

b07789935a33252cc66209e7d4fedde5
SHA1

47086f14e0c759b42b12a4e03f64dae2a6f6f62b
SHA256

80c29357f8b7bd6cbd578a2425d5af03fa97845e50f261073c85b1cd71c2a2ba
SHA512

eb27fb720cbba4c494aff35ea488fa727cc1e149220236b3c756100c8425b0ef4722f88dcbb1f1a616e20346423dd8a3f1abc2ea3ae6bbffc10ae561afe196f7
SSDEEP

49152:FtBrQe0gu+7qjkCaGpATzsdvxDcG8260tt0C3n:LB0e0B7aoAHs/D96Ot

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral1/memory/4251-0.dex	family_hydra1
behavioral1/memory/4226-0.dex	family_hydra1

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.enforce.very
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.enforce.very

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.enforce.very/app_DynamicOptDex/At.json	4251	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.enforce.very/app_DynamicOptDex/At.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.enforce.very/app_DynamicOptDex/oat/x86/At.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.enforce.very/app_DynamicOptDex/At.json	4226	com.enforce.very

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Reads information about phone network operator.

com.enforce.very
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:4226
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.enforce.very/app_DynamicOptDex/At.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.enforce.very/app_DynamicOptDex/oat/x86/At.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4251

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.enforce.very/app_DynamicOptDex/At.json

Filesize
239KB

MD5
53ee3f79a1a688bd7450acb908c22339

SHA1
b1434932aaad29a7c8d749b1f9a5e1e735b8ae9f

SHA256
e7b2aca2f7609cf525ced7eff0c1c5897f566a5804262bb89e84dbc1d9f7e516

SHA512
f2ab5a9cbc6bb5402ed75a666132aac59537196881f3873119a9299f48158d9fdc1a59446e0f946ae351ca09842d3e4914e2c5979cd18dc5ccd0552305baafff

Download Submit
/data/data/com.enforce.very/app_DynamicOptDex/At.json

Filesize
239KB

MD5
7ec79fcc88b5a2e3af780d68aaec1943

SHA1
fc7623ff9f354ddaa776ade36dfaa659f6c259ad

SHA256
867b9201be46d85fe0c2c429412b8a2e85fc175a5ec888262b8d3221d826a483

SHA512
b7f9fabe207b2c1a786eb6d4fcceb4becaa43b481c8db004dc1bf6bbf7e444c2234f299d1665def982b1a233ce106384a08de2a1e4740892bcf9bde9873161b1

Download Submit
/data/data/com.enforce.very/app_DynamicOptDex/oat/At.json.cur.prof

Filesize
1KB

MD5
36afd3ff1bb3fdbdc25b9c5b5b73548f

SHA1
da63010ce97b53ad7cf5c2659872473ead988f78

SHA256
e061617e94e11bc95439a5c64e3426abdd93ca5893e007c896a7cafec8500ee4

SHA512
1c72b08be1ec2848847d4ef7033307dc9154ced2288ec15cf64345fe5a683a63072363a33dd821b9caf9b1f689e7374267dd5a738f0d3fca7741e9205c358709

Download Submit
/data/user/0/com.enforce.very/app_DynamicOptDex/At.json

Filesize
574KB

MD5
ce9acb107df0c4ff35ffc91544f6a54e

SHA1
101ce2ba33f49e7416a081d9c5b8778735699345

SHA256
5a6acf865a2c618ac595e607e1d90fdd09adc4ed43ee9dc2099c477b3e3b11a4

SHA512
1b5c0a10098aff0aa235d94a0fa4bcc380c812c8aaeb9ad3a40689474256afec1c6a0cf29aac962266401a70b16a6a1d98a3d32c40ffe9456abd6f91279ae21d

Download Submit
/data/user/0/com.enforce.very/app_DynamicOptDex/At.json

Filesize
574KB

MD5
7e7986a426f15d4c6858a5756fdfc942

SHA1
aa57090216f257cdde732f1302991427b8fd27a3

SHA256
88ebd2e358b13ab3f48d354545dfaaf8031886ca843c62eddd0df81534c8bb99

SHA512
a0d20cbb642b44eb34906528bd50043b81495e4f8759929f817edf91ac32d32aa5ce97549d399e5dab2df5e26aef8ff4220eea487c6ef3b7fae2e8edc26db9aa

Download Submit