hydra | 0b20accac922de51e34a7dc637841d6071c92929ae9dc566f043b268871b58dc

Analysis

max time kernel
149s
max time network
152s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
06-03-2024 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7fd23008ba0a521e2155fab6e50433c.apk
Size

3.3MB
MD5

b7fd23008ba0a521e2155fab6e50433c
SHA1

2cc0c9b7ffe598f2af7a40141270f901699b0156
SHA256

0b20accac922de51e34a7dc637841d6071c92929ae9dc566f043b268871b58dc
SHA512

9e9acb73c1e34ec319a70cc0710003bc2c3884fdb44b31937985a81b437e743b41bd4f55f2f2236a5b75957b6ed916e206f4ea2dfaf788c894dcd289d0b77a45
SSDEEP

98304:6hskdTAKH/appP/VbuB4ZzbjtiiLd1Vn8t8QtoLf6I5:6hVx/aDlnzbj9Z86MoLfX5

Score

10^/10

hydra banker collection discovery evasion infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.oaakxqhl.lolwxjv
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.oaakxqhl.lolwxjv

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.oaakxqhl.lolwxjv/code_cache/secondary-dexes/base.apk.classes1.zip	4603	com.oaakxqhl.lolwxjv

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.oaakxqhl.lolwxjv
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:4603

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.oaakxqhl.lolwxjv/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
902KB

MD5
71d629430236a02d87abee012a20936f

SHA1
3acc6c4af7265966af32d12d3ab58e066994eaa8

SHA256
c6b36924c4e52141379fe53314fec87b3833b945c3ef90edd4c10c420af8c9d5

SHA512
0e09ebadcdfe2e96c9b998e0531edc7baace8c2b4d056217dffb4b45d26c83567935bf1c9816c092c7448766ed13c033a0efe282263a0c04ce660e0e604b4b39

Download Submit
/data/user/0/com.oaakxqhl.lolwxjv/code_cache/secondary-dexes/tmp-base.apk.classes340705023674902201.zip

Filesize
378KB

MD5
7547adef0ad97c1138e758856cba81f1

SHA1
a3728fd5b9e1545b551aae98a0395c70b343d816

SHA256
345b19ac97767549ebc291b157e4c9191a2d6703abbfee9a2d1304d8911ad040

SHA512
74cf860e444bbafa78f33229e8de516a19fdeb89e4173dd416d708c9ffab0c02f6f47550a9af64758b9d2a468dc930cb476983f1b4dc8e34c838a33b426adca1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads