hydra | d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7

Analysis

max time kernel
179s
max time network
136s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
30-07-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7.apk
Size

4.3MB
MD5

4139c26388e4dc5ca08b36d103b225ea
SHA1

f656e5c271fe5fed3b23d28a52a9790b2fcbd3ba
SHA256

d1bffe037087229a3ee86d4ab6a5f9e8f9de9c97b062055dcc09e95a0a63d7a7
SHA512

e35d2389383d027f9b3b71e5f11b3b3b245c6ce39d7b2aade9d424f3903324fd51c9bc692a5309ae2528b70c562bc366c49717b21bff2bf45fc73916f91acb09
SSDEEP

98304:P10YaLxIEJ+gfScHk/xVnqBtO8ydyuFQ5AVJAz2B:PCYa1IOqcEDnktOJM5+JN

Score

10^/10

hydra banker collection credential_access discovery evasion infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-2.dat	family_hydra1

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/peace.close.visit/app_DynamicOptDex/coiC.json	4431	peace.close.visit
/data/user/0/peace.close.visit/app_DynamicOptDex/coiC.json	4431	peace.close.visit

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	peace.close.visit
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	peace.close.visit

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	peace.close.visit

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	peace.close.visit

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

peace.close.visit
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
PID:4431

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/peace.close.visit/app_DynamicOptDex/coiC.json

Filesize
2.8MB

MD5
74ff72f8e4bcb5900c2a77b23de3ac08

SHA1
1831e0eb53a220944e34887750e80ef15f712fbd

SHA256
a4264e05a0e7d5706f172e4e147ba67554746afe777ccbba42f704c568ee57e4

SHA512
1df2abd8bf4592973c1ec684f1abf346fb58fdf5fb1cb74034bf8917474c6eb763d52615f6c76a8aa0230d43012744c4370513e5be2b07b50296d0f22c0a2422

Download Submit
/data/user/0/peace.close.visit/app_DynamicOptDex/coiC.json

Filesize
2.8MB

MD5
7495823ba52181d27f45f06d201af7a5

SHA1
5289daca409d49f3b2978fd74797f595eef34021

SHA256
ed5ab4f6f745d018831406077343ce16f52a15f171e69d6c33392e207b10620c

SHA512
f8c06ffda50f7c4b3dda241818808cad082f4ec77b985dad483a78d56630bd1dcdee45412a4069bac3d2434707bcb243e9998c2fb558c46af226310a9a8cbc33

Download Submit
/data/user/0/peace.close.visit/app_DynamicOptDex/oat/coiC.json.cur.prof

Filesize
1KB

MD5
84e9c2ec91d9e82e3bbb589018af220e

SHA1
cff9e09c2f3a067afb40c2afc3670f520b7fcdef

SHA256
917fdca1828d10e85c4c5aaeacdc0c260b66646537e8dd8c79c56b71c509b323

SHA512
e8abf05f7716f85fc7c795a2e602efe810d0c1528658e34dd2fad8a7a2d682c26c0d657447df8d6033f1d8b315302fbc152d7550b856b9ee0c825d0614e4466b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads