hydra | 13e082e408ee870c35487ba8b2589a44a14e4048bab5b647af0e0f03075ae80a

Analysis

max time kernel
3080388s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
29-12-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13e082e408ee870c35487ba8b2589a44a14e4048bab5b647af0e0f03075ae80a.apk
Size

2.1MB
MD5

0351b970d847aa86f2b2bc1fb8400cef
SHA1

76d6c57c873099e6c62ad78c61df40e11a8fc26e
SHA256

13e082e408ee870c35487ba8b2589a44a14e4048bab5b647af0e0f03075ae80a
SHA512

99595a7704651723243cc8f2e4161b8d6c4446b57481349284c57b9d5fbc4257764e62d5ab44ac13e556085cf39634ed20f19321741c2f8fa1bb05d36e87383b
SSDEEP

49152:ol2EVGP1f6qZhw2rgrpCjQavyOgA28eiEKhJqBAtCQa:C2GGd6qZh73v728eiE7BA4j

Score

10^/10

hydra banker infostealer trojan

Malware Config

Extracted

Family

hydra

http://ikincipansizde.net

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral3/memory/4636-0.dex	family_hydra1
behavioral3/memory/4636-0.dex	family_hydra2

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sing.lens
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sing.lens

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json	4636	com.sing.lens

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.sing.lens

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com

Reads information about phone network operator.

com.sing.lens
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json

Filesize
1.3MB

MD5
d87a652ac61912354851da39fa6bfebf

SHA1
77b899abb35ab717d83f85952568a3b59f1fc423

SHA256
24d83940f74d095c3bd8d3974322e72591a722c0217e6b0a8c7e16c9076f4879

SHA512
64d14f6048d488470f375301cb9b18f4661d3d6f113e22eba641e019fdb2f4f2cd3a8a13dd7efab60349ec0e42617172c7ae72d771e9545f23acd1e326fa6424

Download Submit
/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json

Filesize
1.3MB

MD5
fb9b054c2a9ff84803a09bfde298e41b

SHA1
3a002f2e86536e8d90fb367dc35d199a7d41b911

SHA256
afa271afb94a7ada5cce30289a18510f43d8d8c68209f981774b888826e03510

SHA512
af049dff0ead62bea37783834dc87328c5f5ea1020e9b991c905bd76dbbee671b4a0c4eac1e5ac08aaa30f1866c66c04af0f98978c16b2c1a7e698d3608de8d9

Download Submit
/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json

Filesize
3.6MB

MD5
82dc3c4f854a3f634ba4bee269af64ce

SHA1
375f4c0f649a17cfac27bc95c8cd4da69a216a1b

SHA256
9b7e122aa9079a64b4de201f7cb283d2cc3603d661d5c8b6d91c414dcddc7ac4

SHA512
507b26f7ecf849a92857ffae10f37df05433bb4a1c4483190d227cd8043e701aa6bf85e3560c30bb294d63d40e6f917ad90a50fe032dafa91f584b3dfac3430b

Download Submit