hydra | a6a6ece0976dccad4ecbdb686f7d704bba91bbd234b6056b83004091e12ee0aa

Analysis

max time kernel
149s
max time network
160s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
16-03-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6a6ece0976dccad4ecbdb686f7d704bba91bbd234b6056b83004091e12ee0aa.apk
Size

2.1MB
MD5

9da9296bcce45a5e25571ce8c682117d
SHA1

618998ccc33a7f6be9f2732b2ede1f49beb158d7
SHA256

a6a6ece0976dccad4ecbdb686f7d704bba91bbd234b6056b83004091e12ee0aa
SHA512

837784684354c93fc3afdbac56565df7529036e8429d9fc79121807f582b43a27a05d9c247491cd9b4d0a026f3600c20987cd85fa80a306726e3cccea30b2af6
SSDEEP

49152:0d+mweBjzqe3R9KglU6qZhw2rgrpCjQavyOgA28eiEKhJqVoqKX:0EmweBjzqQRRU6qZh73v728eiE7Vot

Score

10^/10

hydra banker collection discovery evasion infostealer trojan

Malware Config

Extracted

Family

hydra

http://ikincipansizde.net

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 2 IoCs

resource	yara_rule
behavioral3/memory/4471-0.dex	family_hydra1
behavioral3/memory/4471-0.dex	family_hydra2

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sing.lens
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sing.lens

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json	4471	com.sing.lens

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.sing.lens

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ip-api.com

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.sing.lens
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
PID:4471

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json

Filesize
1.3MB

MD5
d87a652ac61912354851da39fa6bfebf

SHA1
77b899abb35ab717d83f85952568a3b59f1fc423

SHA256
24d83940f74d095c3bd8d3974322e72591a722c0217e6b0a8c7e16c9076f4879

SHA512
64d14f6048d488470f375301cb9b18f4661d3d6f113e22eba641e019fdb2f4f2cd3a8a13dd7efab60349ec0e42617172c7ae72d771e9545f23acd1e326fa6424

Download Submit
/data/user/0/com.sing.lens/app_DynamicOptDex/ke.json

Filesize
3.6MB

MD5
82dc3c4f854a3f634ba4bee269af64ce

SHA1
375f4c0f649a17cfac27bc95c8cd4da69a216a1b

SHA256
9b7e122aa9079a64b4de201f7cb283d2cc3603d661d5c8b6d91c414dcddc7ac4

SHA512
507b26f7ecf849a92857ffae10f37df05433bb4a1c4483190d227cd8043e701aa6bf85e3560c30bb294d63d40e6f917ad90a50fe032dafa91f584b3dfac3430b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads