Overview

overview

10

Static

static

6

ddf446f216...c3.apk

android-9-x86

10

ddf446f216...c3.apk

android-10-x64

10

ddf446f216...c3.apk

android-11-x64

10

Resubmissions

01-08-2024 12:55

240801-p546ga1fmn 10

17-04-2024 22:00

240417-1wslvsgf3y 10

Analysis

  • max time kernel
    157s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    17-04-2024 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ddf446f2164bcf6bd46af668dd245fafb3c32d7b5620bfa7577978a8ace2acc3.apk

  • Size

    1.2MB

  • MD5

    8660acf5909d0af99d843b2e268d16ae

  • SHA1

    6f7649255b1cb7950e19e8ce78dcdf33b62020d7

  • SHA256

    ddf446f2164bcf6bd46af668dd245fafb3c32d7b5620bfa7577978a8ace2acc3

  • SHA512

    e6531e8290676614f0f46730f7bab1c3414efafef656d37d4142549b316e0df5718a8eb4211feb29f3d7b853b7968983618640fd3569dabb4c2266e85da2ff39

  • SSDEEP

    24576:8FjqE4sijToAeMf2w9jrf28k434tyqtG5pbheOoeEj6+DhssEja:s4scTX9jrf2wqoj4N6s1Eja

Score
10/10
hydrabankercollectiondiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

hydra

C2

http://mersintantuniad33.com

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator. 1 TTPs
    discovery

Processes

  • com.grand.snail
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Reads the contacts stored on the device.
    PID:5032

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.grand.snail/app_mph_dex/classes.dex
    Filesize

    2.2MB

    MD5

    ccfaf0cba913b26cc3f6994cddd05549

    SHA1

    a4b302c886d8284187dd81123efd8039a072d119

    SHA256

    eed2e1a100238dbfdd57a185e36ebe34d88cf6ee739e2f740d6a5d0291ed0814

    SHA512

    a0d130fcb9d8558aef98171e08056914bfee6e217d91a3fc400f0cf95bf9a6c655c2698ae8323eaaee48fa29112eee2ee4d1b3456870d282e0e2ad21b094ef18

    Download Submit

  • /data/data/com.grand.snail/app_mph_dex/oat/classes.dex.cur.prof
    Filesize

    1KB

    MD5

    5bc6af137fcf1ee75c4cd1d9767cc9b8

    SHA1

    82b4eb433e8b6586ad6f039a505f31e929c83991

    SHA256

    fb044aad646129f03e9e4c24fe6a297dc62a9fa69f5742e41ff579c3f35428d4

    SHA512

    b0845e0e9c0f6a89c6739c46719ff83b726b036c035614d95bbb763959bf29e0aa4014101e2075db8a6c727c49d31fe38f7f7201593edb63f2711c1c3b2fdef2

    Download Submit