hydra | a3b826de0c445f0924c50939494a26b0d99ef3ccac80faacca98673625656278

Analysis

max time kernel
2498050s
max time network
155s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20-12-2023 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b826de0c445f0924c50939494a26b0d99ef3ccac80faacca98673625656278.apk
Size

3.9MB
MD5

29dbb4d3b12ef397538f6bfc04005af4
SHA1

a66e0803bcd3de355c4a0bbfc8cbe37141564b89
SHA256

a3b826de0c445f0924c50939494a26b0d99ef3ccac80faacca98673625656278
SHA512

5abfd4248dc26e17b751158fa8099db65f13eb96a1194d6d2d73a0ff8ee518b346d0ccd31eca8ae59822f950b22ab0861077fcbac067c864ed812fc19ae8d544
SSDEEP

98304:KoFFYtf1csBoNed4ri6MUp28jXTzUQqMMb5hMhk3hl1pcTSyFtBUZ:KtocIi6MQj3UQqMMOk3hl1pcTSyFtqZ

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral2/memory/4987-0.dex	family_hydra1
behavioral2/memory/4987-0.dex	family_hydra2

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.almost.sign
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.almost.sign

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.almost.sign/app_DynamicOptDex/ZLGn.json	4987	com.almost.sign

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com

Reads information about phone network operator.

com.almost.sign
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:4987

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.almost.sign/app_DynamicOptDex/ZLGn.json

Filesize
1.9MB

MD5
82cd5f1eac6ecdd7bddcd9c4a98c6dd3

SHA1
47e12b219cd9a394886e7857d1d4a4b82bacb1b0

SHA256
405e53c858b168a50a97a65d45405b68a092b193fe1a140ba9b223a5a3ef7de1

SHA512
0a7d85589cf4d8ba1a5d10a91351748eafddf27744c8d4018cbc787d9b0e9de53fdd6f89e0a88520642da25290d3406d821656436c689339a39dc93dc821c134

Download Submit
/data/data/com.almost.sign/app_DynamicOptDex/oat/ZLGn.json.cur.prof

Filesize
1KB

MD5
2b3bf0b1b26ea8766f057e66fd250e2e

SHA1
a2f1cd9c15c2ea55a1d8503f3fd62eb8f1956a86

SHA256
029ecdd5d07a4fb28d8b5e745d59224fd61c8eed778c58ef0a1688a568845ca4

SHA512
dc56deff9f1faa139c6fcccf0af4f3a87ffeb3aea75fe1768fe989cbb184a988d64174f518b79fd1fdb964de00f9543cbb27aa1d659126857ec4c74595aae597

Download Submit
/data/user/0/com.almost.sign/app_DynamicOptDex/ZLGn.json

Filesize
5.0MB

MD5
412826ee6d6fab98a5471008a2cd1118

SHA1
17ae43b5a9128d4df9c140833bf696c42bf04ccb

SHA256
26fdc35c4216c1b7a810ac2e341630cca4b5faa92561df7c42ccb6ea408a8d7f

SHA512
8f2c5b00a730a114384f7250d2a728283909da3849bdc6f2a222891a318db520fa414ff03135afb07bf3ef44aa5af8d5efb716f1a74cf4221a5c89321d963678

Download Submit