hydra | 9ec93f30a4d4c404687abd67f4aeb19d2f50b16c7662e41aba8f86a5407ba14d

Analysis

max time kernel
2466420s
max time network
161s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20/12/2023, 09:49 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ec93f30a4d4c404687abd67f4aeb19d2f50b16c7662e41aba8f86a5407ba14d.apk
Size

2.4MB
MD5

b11e72c94d810958df65d8716d853bc3
SHA1

606a5eaf439586fc316a3befc85431091bfa786e
SHA256

9ec93f30a4d4c404687abd67f4aeb19d2f50b16c7662e41aba8f86a5407ba14d
SHA512

c18853c87af0198a0d19d097e1f83e0044d32b3d676a23dd0cd132499d098a951d31777153e6c6e9f9710b3fc28e74129173fc90b6c7ab2711a34a84ff5b98c5
SSDEEP

49152:ZxkyYHERA1iUZXObVbVIrobX57/prbB5Wk4HMIyzNZ60/KrYvTD0iXXYMZ04YKx:ZxkyYke1iiYbe0L57/ZjWJHMIyxwQKs3

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral2/memory/4917-0.dex	family_hydra1

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.scare.obscure
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.scare.obscure

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.scare.obscure/app_DynamicOptDex/Yy.json	4917	com.scare.obscure
/data/user/0/com.scare.obscure/app_DynamicOptDex/Yy.json	4917	com.scare.obscure

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Reads information about phone network operator.

com.scare.obscure
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:4917

Network

DNS

ssl.google-analytics.com

Remote address:

1.1.1.1:53

Request

ssl.google-analytics.com

IN A

Response

ssl.google-analytics.com

IN A

216.58.201.104
DNS

ssl.google-analytics.com

Remote address:

1.1.1.1:53

Request

ssl.google-analytics.com

IN A
DNS

ip-api.com

Remote address:

1.1.1.1:53

Request

ip-api.com

IN A

Response

ip-api.com

IN A

208.95.112.1
DNS

ip-api.com

Remote address:

1.1.1.1:53

Request

ip-api.com

IN A
GET

http://ip-api.com/json

Remote address:

208.95.112.1:80

Request

GET /json HTTP/1.1
Authorization: 6c9b136cb10f696a
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
Host: ip-api.com
Connection: Keep-Alive
Accept-Encoding: gzip

Response

HTTP/1.1 200 OK

Date: Fri, 22 Dec 2023 19:28:52 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 313
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
DNS

gist.githubusercontent.com

Remote address:

1.1.1.1:53

Request

gist.githubusercontent.com

IN A

Response

gist.githubusercontent.com

IN A

185.199.111.133

gist.githubusercontent.com

IN A

185.199.108.133

gist.githubusercontent.com

IN A

185.199.110.133

gist.githubusercontent.com

IN A

185.199.109.133
GET

https://gist.githubusercontent.com/ferrari458italy/4fe02ee186816abcfcca6eaaed44659d/raw/helloworld.json

Remote address:

185.199.111.133:443

Request

GET /ferrari458italy/4fe02ee186816abcfcca6eaaed44659d/raw/helloworld.json HTTP/1.1
Authorization: 6c9b136cb10f696a
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
Host: gist.githubusercontent.com
Connection: Keep-Alive
Accept-Encoding: gzip

Response

HTTP/1.1 404 Not Found

Connection: keep-alive
Content-Length: 14
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
Content-Type: text/plain; charset=utf-8
X-GitHub-Request-Id: 0BCE:391231:359DD63:37CBFCE:6585E374
Accept-Ranges: bytes
Date: Fri, 22 Dec 2023 19:28:54 GMT
Via: 1.1 varnish
X-Served-By: cache-lon4220-LON
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1703273334.921147,VS0,VE136
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 3365859a8813f896d8ec5808711d6a3ed8ac6ba3
Expires: Fri, 22 Dec 2023 19:33:54 GMT
Source-Age: 0
DNS

android.apis.google.com

Remote address:

1.1.1.1:53

Request

android.apis.google.com

IN A

Response

android.apis.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

216.58.201.110

216.58.201.104:443

ssl.google-analytics.com

tls

1.3kB
5.8kB
8
7
208.95.112.1:80

http://ip-api.com/json

http

452 B
662 B
5
4

HTTP Request

GET http://ip-api.com/json

HTTP Response

200
185.199.111.133:443

https://gist.githubusercontent.com/ferrari458italy/4fe02ee186816abcfcca6eaaed44659d/raw/helloworld.json

tls, http

1.4kB
5.5kB
10
7

HTTP Request

GET https://gist.githubusercontent.com/ferrari458italy/4fe02ee186816abcfcca6eaaed44659d/raw/helloworld.json

HTTP Response

404
172.217.16.238:443

tls, https

857 B
40 B
1
1
216.58.201.110:443

android.apis.google.com

tls

7.8kB
8.8kB
26
23
142.250.178.4:443

tls, https

456 B
40 B
2
1
142.250.178.4:443

www.google.com

tls

9.5kB
8.7kB
28
33
142.250.187.206:443

520 B
10
216.58.201.98:443

520 B
10

224.0.0.251:5353

3.7kB
11
1.1.1.1:53

ssl.google-analytics.com

dns

140 B
86 B
2
1

DNS Request

ssl.google-analytics.com

DNS Request

ssl.google-analytics.com

DNS Response

216.58.201.104
1.1.1.1:53

ip-api.com

dns

112 B
72 B
2
1

DNS Request

ip-api.com

DNS Request

ip-api.com

DNS Response

208.95.112.1
1.1.1.1:53

gist.githubusercontent.com

dns

72 B
136 B
1
1

DNS Request

gist.githubusercontent.com

DNS Response

185.199.111.133

185.199.108.133

185.199.110.133

185.199.109.133
1.1.1.1:53

android.apis.google.com

dns

69 B
109 B
1
1

DNS Request

android.apis.google.com

DNS Response

216.58.201.110

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.scare.obscure/app_DynamicOptDex/oat/Yy.json.cur.prof

Filesize
937B

MD5
1a071e7e83e9df9e8c0a0d01658b6aad

SHA1
21d5a97f6be8713ac07ffac74d53b6b8c3b09935

SHA256
fbb4e90fd4d1c722e12910c9ab9e7ebd550fa3a9336acfe210e36e32612b984f

SHA512
a848ded2ae7c66e32ac572b013e7be7dec1396d9de7c04a9f9f09740234958a7cb8d2d225dc3800be56a1957f58783797d7b7e651ed59d06c31a1e63e5e45452

Download Submit
/data/user/0/com.scare.obscure/app_DynamicOptDex/Yy.json

Filesize
573KB

MD5
1e11861994b5b31e4c58c224eef13532

SHA1
1f283ac3c312401df111388d1c295a975adc37f8

SHA256
75491e51cbe3aff4632b5ade80f77ce14b0ccdff422ff3c457dd5552e9693697

SHA512
3543ab0858bc0ab478c35c28d419866d556c1e5cc081416ed03ceb8f601bc99f65a97c6c537cb501b26fa3bd09a3e3d813f926df46a3f886616e40d8683717c0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.