hydra | 80c29357f8b7bd6cbd578a2425d5af03fa97845e50f261073c85b1cd71c2a2ba

Analysis

max time kernel
2340627s
max time network
134s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20/12/2023, 03:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

80c29357f8b7bd6cbd578a2425d5af03fa97845e50f261073c85b1cd71c2a2ba.apk
Size

1.9MB
MD5

b07789935a33252cc66209e7d4fedde5
SHA1

47086f14e0c759b42b12a4e03f64dae2a6f6f62b
SHA256

80c29357f8b7bd6cbd578a2425d5af03fa97845e50f261073c85b1cd71c2a2ba
SHA512

eb27fb720cbba4c494aff35ea488fa727cc1e149220236b3c756100c8425b0ef4722f88dcbb1f1a616e20346423dd8a3f1abc2ea3ae6bbffc10ae561afe196f7
SSDEEP

49152:FtBrQe0gu+7qjkCaGpATzsdvxDcG8260tt0C3n:LB0e0B7aoAHs/D96Ot

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral2/memory/5080-0.dex	family_hydra1

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.enforce.very
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.enforce.very

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.enforce.very/app_DynamicOptDex/At.json	5080	com.enforce.very

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Reads information about phone network operator.

com.enforce.very
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.enforce.very/app_DynamicOptDex/At.json

Filesize
239KB

MD5
53ee3f79a1a688bd7450acb908c22339

SHA1
b1434932aaad29a7c8d749b1f9a5e1e735b8ae9f

SHA256
e7b2aca2f7609cf525ced7eff0c1c5897f566a5804262bb89e84dbc1d9f7e516

SHA512
f2ab5a9cbc6bb5402ed75a666132aac59537196881f3873119a9299f48158d9fdc1a59446e0f946ae351ca09842d3e4914e2c5979cd18dc5ccd0552305baafff

Download Submit
/data/data/com.enforce.very/app_DynamicOptDex/At.json

Filesize
239KB

MD5
7ec79fcc88b5a2e3af780d68aaec1943

SHA1
fc7623ff9f354ddaa776ade36dfaa659f6c259ad

SHA256
867b9201be46d85fe0c2c429412b8a2e85fc175a5ec888262b8d3221d826a483

SHA512
b7f9fabe207b2c1a786eb6d4fcceb4becaa43b481c8db004dc1bf6bbf7e444c2234f299d1665def982b1a233ce106384a08de2a1e4740892bcf9bde9873161b1

Download Submit
/data/data/com.enforce.very/app_DynamicOptDex/oat/At.json.cur.prof

Filesize
1KB

MD5
f9958fe716a93988d0f9c48301009329

SHA1
9b463c2ef10bcc8aa334e1e3c5229d50df7a5879

SHA256
1567ec80ea811c99d418acafa588c94b91876cb1b7c3d53688168ccf8b49c7d4

SHA512
01c45787b8cbde5391bafd137fa430afa5aa346b51f8c15d9bf1c4eadf7cfaae44665fa084187656e42a03b09e8b6eacfc7b5a30b49f371e92b228d847397d06

Download Submit
/data/user/0/com.enforce.very/app_DynamicOptDex/At.json

Filesize
574KB

MD5
7e7986a426f15d4c6858a5756fdfc942

SHA1
aa57090216f257cdde732f1302991427b8fd27a3

SHA256
88ebd2e358b13ab3f48d354545dfaaf8031886ca843c62eddd0df81534c8bb99

SHA512
a0d20cbb642b44eb34906528bd50043b81495e4f8759929f817edf91ac32d32aa5ce97549d399e5dab2df5e26aef8ff4220eea487c6ef3b7fae2e8edc26db9aa

Download Submit