hydra | 3640f09bff39e3a943195ecac50c30017890013dadc9d8528fd2220e218f9abe

Analysis

max time kernel
3031239s
max time network
130s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
24-12-2023 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

011376f46a9ce15f6871530ba02465ce.apk
Size

4.8MB
MD5

011376f46a9ce15f6871530ba02465ce
SHA1

d94107888bdfbffcabc6ccb1608f741ee220e97e
SHA256

3640f09bff39e3a943195ecac50c30017890013dadc9d8528fd2220e218f9abe
SHA512

30738bad30be433c0a6b59b28b5478bb8530f54c13ac32cbb21315d7ecef1a4e742ed76683cfb071850281bdd7dfb01117f091126528b3f3f615ed88429d6a99
SSDEEP

98304:6bWNylJAL3ubx87R5wA40fdQtSiUythyCmXsl4gh:6iolJAL3ubx87HwA4WfiUyth/usKgh

Score

10^/10

hydra banker infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	family_hydra1
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	family_hydra1

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

possible.stay.tank

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	possible.stay.tank
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	possible.stay.tank

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

possible.stay.tank/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/possible.stay.tank/app_DynamicOptDex/oat/x86/wuwJxr.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	4246	possible.stay.tank
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	4271	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/possible.stay.tank/app_DynamicOptDex/oat/x86/wuwJxr.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json	4246	possible.stay.tank

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
Reads information about phone network operator.

flow	ioc
8	ip-api.com

possible.stay.tank
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:4246

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/possible.stay.tank/app_DynamicOptDex/oat/x86/wuwJxr.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4271

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/possible.stay.tank/app_DynamicOptDex/oat/wuwJxr.json.cur.prof
Filesize
568B

MD5
151d3b7fcc04080d6f62e2a0d5985fac

SHA1
843c54150f92628335ff398ed37fcb6a557fbe86

SHA256
eaf49e686f4e13c33eaa3e36fb55da4dbcc0124c6738121ef26eb136cb465ca6

SHA512
b045b0dcca06987db2715eecff78423b8bef4c5c2ff3db5d3e2c221cac6212d5f87c9706772d83297327ada2fe64bb06644eea219bc8c6f9b778fe900a529666

Download Submit
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json
Filesize
2.8MB

MD5
386c9e8f49720a742a518523d4f32140

SHA1
c8fcf5da3d78173798297dc52f101ff908868dd4

SHA256
2c20eb3cc10b45bf55cdad1c01469c3ebb2341404fbc7e4c01bc4b51ab210aa3

SHA512
20c74e0bed28e55c71372c2c45e273c2d75fa88fd35d7afa81caffa57cba0f175408b2a68fa0dcaec87e7949ad3b90561f7b380d6af4678d12363fbb550d38b5

Download Submit
/data/user/0/possible.stay.tank/app_DynamicOptDex/wuwJxr.json
Filesize
2.8MB

MD5
d6b191cb3ff6e837c78b2c33de83014f

SHA1
7ba62d7fb961b896795286374f35516212cd9642

SHA256
ce5f88e9dfd1cca6f890a3ce5f0f39b8855d99a3316efb45119fb4bdc22e1549

SHA512
b82ff24856ff1e0d1ca30dac542d166911573d09ec6e1b1deb783429fe2d98f38d1a80f1a93a6487731c29b9ad04f874d1b3b0552833f28a4868669b11eacad1

Download Submit