Overview

overview

10

Static

static

6

ddf446f216...c3.apk

android-9-x86

10

ddf446f216...c3.apk

android-10-x64

10

ddf446f216...c3.apk

android-11-x64

10

Resubmissions

01-08-2024 12:55

240801-p546ga1fmn 10

17-04-2024 22:00

240417-1wslvsgf3y 10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    17-04-2024 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ddf446f2164bcf6bd46af668dd245fafb3c32d7b5620bfa7577978a8ace2acc3.apk

  • Size

    1.2MB

  • MD5

    8660acf5909d0af99d843b2e268d16ae

  • SHA1

    6f7649255b1cb7950e19e8ce78dcdf33b62020d7

  • SHA256

    ddf446f2164bcf6bd46af668dd245fafb3c32d7b5620bfa7577978a8ace2acc3

  • SHA512

    e6531e8290676614f0f46730f7bab1c3414efafef656d37d4142549b316e0df5718a8eb4211feb29f3d7b853b7968983618640fd3569dabb4c2266e85da2ff39

  • SSDEEP

    24576:8FjqE4sijToAeMf2w9jrf28k434tyqtG5pbheOoeEj6+DhssEja:s4scTX9jrf2wqoj4N6s1Eja

Score
10/10
hydrabankercollectionevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

hydra

C2

http://mersintantuniad33.com

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 4 IoCs
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

Processes

  • com.grand.snail
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Reads the contacts stored on the device.
    PID:4267
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.grand.snail/app_mph_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.grand.snail/app_mph_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4295

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.grand.snail/app_mph_dex/classes.dex
    Filesize

    2.2MB

    MD5

    ccfaf0cba913b26cc3f6994cddd05549

    SHA1

    a4b302c886d8284187dd81123efd8039a072d119

    SHA256

    eed2e1a100238dbfdd57a185e36ebe34d88cf6ee739e2f740d6a5d0291ed0814

    SHA512

    a0d130fcb9d8558aef98171e08056914bfee6e217d91a3fc400f0cf95bf9a6c655c2698ae8323eaaee48fa29112eee2ee4d1b3456870d282e0e2ad21b094ef18

    Download Submit

  • /data/data/com.grand.snail/app_mph_dex/oat/classes.dex.cur.prof
    Filesize

    1KB

    MD5

    87c69bda44b6d469b5e3268d8980ba9c

    SHA1

    b65c75977d3c14edb9ff6050b808ff1d06f4d838

    SHA256

    eae337f3b70601b069a897f183591f458ac985de3b621b491020c865e763a0aa

    SHA512

    626363ac4a3481992d8769a5354c9285aa1413ef5b15286fd12458450408d75fd464d15741cbfb028473f381ea24e2d163d51bc3017676e3700a728fde1a55fa

    Download Submit

  • /data/user/0/com.grand.snail/app_mph_dex/classes.dex
    Filesize

    2.2MB

    MD5

    ac2943c98b696f9a383d607f621bad03

    SHA1

    9735d4e830d5b06483cca2ec7342360984e1ce43

    SHA256

    8111316d5aa99d6f13904a04e70b1ae191dab7ff1fc207e826da0c3b36b4276c

    SHA512

    6ec06215261fa90fec2288cf1764e74c88df15ae309b406ef50c4343f4daccb4b3df198c2c8f8c151ea445f8d110c22c8725534a896c3ab2642d6550e3649b08

    Download Submit