hydra | ea391f65ae367799ab1bc162a4b8dcedb76f1da1e5595548497d943298f18682

Analysis

max time kernel
153s
max time network
136s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
04-04-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbdfddc05f32e4d7421e7b29dc2c2d48_JaffaCakes118.apk
Size

7.5MB
MD5

bbdfddc05f32e4d7421e7b29dc2c2d48
SHA1

c10f45072242b16735dce7bc08b15bce72b6522a
SHA256

ea391f65ae367799ab1bc162a4b8dcedb76f1da1e5595548497d943298f18682
SHA512

8442866d0ba9652549883648f9e1e22d7980f2f43494fd72789934a9138fcc97ff67f3ee73288e9601597c4e5a7ecb1179c4f7acb70284aa96793383fc5fc763
SSDEEP

196608:gzZeTXTF6lHf3kn1pyNUxMDWx0RiQdyjynFAL9D:g9CJp2UxYWabyj40D

Score

10^/10

hydra banker collection discovery evasion infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

com.nhpbwede.sandbga

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nhpbwede.sandbga
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.nhpbwede.sandbga

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.nhpbwede.sandbga

ioc pid process

/data/user/0/com.nhpbwede.sandbga/jh8ptpwgbJ/jcblhnvfUkbbuva/base.apk.ckIkjit1.kaz 5031 com.nhpbwede.sandbga
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

ioc	pid	process
/data/user/0/com.nhpbwede.sandbga/jh8ptpwgbJ/jcblhnvfUkbbuva/base.apk.ckIkjit1.kaz	5031	com.nhpbwede.sandbga

flow	ioc
6	ip-api.com

com.nhpbwede.sandbga
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
PID:5031

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nhpbwede.sandbga/app_torfiles/geoip

Filesize
3.7MB

MD5
da86c56d98ea812ce6ab42691e4d1197

SHA1
e3c910f3b2a6c916c7be33a943091ef57048b72c

SHA256
9f65eab86508224b41cbf319314c070f33fdecb250d17247da83ab7b4d436159

SHA512
62095ef018a1e2664b380056141e54f224458727229b309f101b0961616a0e5feeaf8428b9b788df4a1408304a46f6d38bcaf9edda770dd6752251995ae49235

Download Submit
/data/data/com.nhpbwede.sandbga/app_torfiles/geoip6

Filesize
2.1MB

MD5
18625900e4f9b58af0db8b4a621058df

SHA1
e8bd5b2e6554c27f718f1222667c09680d75f799

SHA256
296911c0f69a26b5fd65f4552f6a141d6cdbb5979f62b8b7db28e7b97e0698f5

SHA512
347006c25eeac5b5cccecd09dafe814cec569e4741c67d3a35dc47d605ef2110adbc0a4e689077c80216059a6a66454bfa525e3cb6fe5b03a781f1f3b8fac6c8

Download Submit
/data/data/com.nhpbwede.sandbga/app_torfiles/tor

Filesize
6.5MB

MD5
3ffe7e540a5be82f50eccd51dde09828

SHA1
e3d9711da7afed4bc89326d3bf80bbfcad7dc5cc

SHA256
805e8995ae913e691ff3e4b6a5fce1c7d11860940ace43a5187a1f548ddcb24b

SHA512
8679cb1df0f82a830e952d0e9628967839dc7a96c178c481dac96ab01c815dec107b4f1b22aa7481aa0071bff9c541d9cb559a0a7268782e3a75874fbbaba7cc

Download Submit
/data/data/com.nhpbwede.sandbga/app_torfiles/torrc

Filesize
99B

MD5
a5537c6e54c265bd4a318bdc057b604c

SHA1
00e834c03f908659e5beeb57a0828b22c2d09acc

SHA256
c0fbdadf36a2b1ef0b4287b66d3a94312915faf5f10b0861e494ea6c40b62c2e

SHA512
062a02b944e990ae4871b53e83fdf15322140f4c50df286488dc1c7ddad423708d4c4eeb97af7518c4bdb54547ee1188822cfacd4ca3ed7032961625a251cac9

Download Submit
/data/data/com.nhpbwede.sandbga/app_torfiles/torrc

Filesize
336B

MD5
ef1d339fec9774769eb3d00f3e897cc0

SHA1
1a8caa23654ebb1d6794ac47403d85e046e99a53

SHA256
20692b83ec6c9f37fa58a884f4a7e8f1547023f6841d27b55a7290f5ff42be0b

SHA512
0ebe96a32bc1503f7993616fe174cd6c1efba95650cccf57f91f153d09dd94a188abf8d13b20037426e4437d626c1ffed92d7284d47dc9d5eb9fe20f6dcaeae0

Download Submit
/data/data/com.nhpbwede.sandbga/jh8ptpwgbJ/jcblhnvfUkbbuva/tmp-base.apk.ckIkjit1273199209908475489.kaz

Filesize
539KB

MD5
4cdd3f0700ddf92349822124b1430edd

SHA1
658b0e40b9dac10823cde9c1c3cc8b0a46e5f627

SHA256
c93fb19e501c42229c34334c2cedc038259c64cc4d3143977ad7d2f8f885b206

SHA512
f44a13afcec3e6b84773610a2b7c766602e1bf89a6edb2b9d68e252c90e072a773d6fe593476fcab85f734ff7f022dd8a39a8d6ce7c5d3e43b24704c64b16466

Download Submit
/data/user/0/com.nhpbwede.sandbga/jh8ptpwgbJ/jcblhnvfUkbbuva/base.apk.ckIkjit1.kaz

Filesize
1.2MB

MD5
3068f0610de37179d9e55a1c48b9440e

SHA1
c83ee13ad5a0e66a7da98839f7111e12c96c27ae

SHA256
d2104acbafe0b2117785ded6c98c2a0e49ffdcddc16b484e58be67d68477e88b

SHA512
90d99350962665d3c0f5ca7c8a6390287f64f1db9de96cba70a3bd755bd0220c8321e441ba5770e0e5c30053e3cb67be590b440b7ef97af347438a008d7d52e4

Download Submit