hydra | c594e0edb7612d5ee07697951429851c9b5553e773add50697a4395227e5ce03 | Triage

Sharing

General

Target

cc35c497b11ad865cd6e601847936d4f
Size

2.3MB
Sample

240315-xyx3ksag66
MD5

cc35c497b11ad865cd6e601847936d4f
SHA1

1041180f91a03e7b34cb13e0f582a88a43d5a02f
SHA256

c594e0edb7612d5ee07697951429851c9b5553e773add50697a4395227e5ce03
SHA512

4cfe56006e422e85fb224e4f12a081ee76c1296ee26245c92de4a2f0a0a43440a4ac395a3d58c4a9d1f7310d8e4871f0f7799b00db97315049376936615beb39
SSDEEP

49152:Eq4A5Ol1XJKBSZxY3yYzVFkOIcm5qAwQ4oYf1ZBB1dtXaSeIxmj9IqvdYeW3B:Ew5uXYBKiCY3dIcmAfQU1HXrXaexmjJK

Score

10^/10

hydra android banker collection discovery evasion infostealer trojan

Malware Config

Targets

- Target
  
  cc35c497b11ad865cd6e601847936d4f
- Size
  
  2.3MB
- MD5
  
  cc35c497b11ad865cd6e601847936d4f
- SHA1
  
  1041180f91a03e7b34cb13e0f582a88a43d5a02f
- SHA256
  
  c594e0edb7612d5ee07697951429851c9b5553e773add50697a4395227e5ce03
- SHA512
  
  4cfe56006e422e85fb224e4f12a081ee76c1296ee26245c92de4a2f0a0a43440a4ac395a3d58c4a9d1f7310d8e4871f0f7799b00db97315049376936615beb39
- SSDEEP
  
  49152:Eq4A5Ol1XJKBSZxY3yYzVFkOIcm5qAwQ4oYf1ZBB1dtXaSeIxmj9IqvdYeW3B:Ew5uXYBKiCY3dIcmAfQU1HXrXaexmjJK
Score

10^/10

hydra banker collection discovery evasion infostealer trojan
- Hydra
  Android banker and info stealer.
  banker trojan infostealer hydra
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3
- Target
  
  vk_dex.apk
- Size
  
  106KB
- MD5
  
  bc185a98eeb3c6854c2caa633295fa3b
- SHA1
  
  cf0b10d87d8d6459ae5b74483d7020dd496800e1
- SHA256
  
  da37cf4de83a645e1b3241879abe4a9e1a2fdb8a5e3f8bbe634509ac660a480d
- SHA512
  
  5bb4bb3aaabf3fa44260c4aec4925fd60901eaf9be83ae661bbb013ca976dc9c4c5d2debea76fc8779ecbd01cf63221b8b6be9951139a972a3b82c92c0fc1c85
- SSDEEP
  
  3072:nQnd9yPnoYlod2kB2zYrp42EUzHGSPIyPzKEmOZPGk9Nt:ywnblhW28ru2kSPIyPz7Gk9L
Score

1^/10
behavioral4 behavioral5 behavioral6

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

hydrabankercollectiondiscoveryevasioninfostealertrojan

behavioral2

hydrabankercollectiondiscoveryevasioninfostealertrojan

behavioral3

hydrabankercollectiondiscoveryevasioninfostealertrojan

behavioral4

behavioral5

behavioral6