hydra | 13e082e408ee870c35487ba8b2589a44a14e4048bab5b647af0e0f03075ae80a

Analysis

max time kernel
3080348s
max time network
155s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
29-12-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13e082e408ee870c35487ba8b2589a44a14e4048bab5b647af0e0f03075ae80a.apk
Size

2.1MB
MD5

0351b970d847aa86f2b2bc1fb8400cef
SHA1

76d6c57c873099e6c62ad78c61df40e11a8fc26e
SHA256

13e082e408ee870c35487ba8b2589a44a14e4048bab5b647af0e0f03075ae80a
SHA512

99595a7704651723243cc8f2e4161b8d6c4446b57481349284c57b9d5fbc4257764e62d5ab44ac13e556085cf39634ed20f19321741c2f8fa1bb05d36e87383b
SSDEEP

49152:ol2EVGP1f6qZhw2rgrpCjQavyOgA28eiEKhJqBAtCQa:C2GGd6qZh73v728eiE7BA4j

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://ikincipansizde.net

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 4 IoCs

resource	yara_rule
behavioral1/memory/4271-0.dex	family_hydra1
behavioral1/memory/4271-0.dex	family_hydra2
behavioral1/memory/4246-0.dex	family_hydra1
behavioral1/memory/4246-0.dex	family_hydra2

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sing.lens
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sing.lens

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json	4271	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.sing.lens/app_DynamicOptDex/oat/x86/ke.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json	4246	com.sing.lens

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.sing.lens

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Reads information about phone network operator.

com.sing.lens
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
PID:4246
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.sing.lens/app_DynamicOptDex/oat/x86/ke.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4271

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sing.lens/app_DynamicOptDex/ke.json

Filesize
1.3MB

MD5
d87a652ac61912354851da39fa6bfebf

SHA1
77b899abb35ab717d83f85952568a3b59f1fc423

SHA256
24d83940f74d095c3bd8d3974322e72591a722c0217e6b0a8c7e16c9076f4879

SHA512
64d14f6048d488470f375301cb9b18f4661d3d6f113e22eba641e019fdb2f4f2cd3a8a13dd7efab60349ec0e42617172c7ae72d771e9545f23acd1e326fa6424

Download Submit
/data/data/com.sing.lens/app_DynamicOptDex/oat/ke.json.cur.prof

Filesize
1KB

MD5
c7259026849bf02c909c9c25203226ce

SHA1
9ce44f3c87f4a196c55769e16ad72fe58cec0e55

SHA256
582147ff3c369bc52a00ce25415239dd523b1bc89c584c1ebfc23f1383d0d0dc

SHA512
d12f75dd2ebd0d5d81637c133638c3612c78340108f058fa8ac30a61ed3f1dc5a8eac88bf18fbf21a21bc24cd61a7f1cf7dc0827f4265ff5cfbfda4206690267

Download Submit
/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json

Filesize
3.6MB

MD5
0f176db8eb7590aff90cb1e9f6b4beba

SHA1
85c0f903e5638e94b1fcd46a80b78854c5307277

SHA256
698aea79f6c28924c6b112fa65c123b9c9bed1bc830fe7b15feb77b711f301f3

SHA512
8c7afa02be8f48cff78d1eb181527a9bbc50bae1fa936a334b81ccfb65d202b48ed37b27df3ff4577e9952771c9024af074dc5eb8555c0b3764846a4b24f78a0

Download Submit
/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json

Filesize
3.6MB

MD5
82dc3c4f854a3f634ba4bee269af64ce

SHA1
375f4c0f649a17cfac27bc95c8cd4da69a216a1b

SHA256
9b7e122aa9079a64b4de201f7cb283d2cc3603d661d5c8b6d91c414dcddc7ac4

SHA512
507b26f7ecf849a92857ffae10f37df05433bb4a1c4483190d227cd8043e701aa6bf85e3560c30bb294d63d40e6f917ad90a50fe032dafa91f584b3dfac3430b

Download Submit