hydra | 4e20b8bf1a926e7d5b84e75c920457d9dc572ec78b9a23d1b08afcefe9b78e5c | Triage

Sharing

General

Target

4e20b8bf1a926e7d5b84e75c920457d9dc572ec78b9a23d1b08afcefe9b78e5c.bin
Size

4.4MB
Sample

240804-11pe1axfpr
MD5

34d77868cbf62fda6b88a5c7b037d3f3
SHA1

00cdfeaa48544e5c6f0ba3d9329bb015e51e5972
SHA256

4e20b8bf1a926e7d5b84e75c920457d9dc572ec78b9a23d1b08afcefe9b78e5c
SHA512

c4e6e76c670d94062cedac1abfa814e2062087cc12626581c66754b642c17f5d296a5e37b546a9549f30a9a96e59daea8e2b7f86786f999b75124791f4bbcd8b
SSDEEP

98304:LCVeYx5HKqvpDRG1DMlRiQQxX/sqS1zHOrBNI:LqXHNvwp5sjzau

Score

10^/10

hydra android banker collection credential_access discovery evasion infostealer persistence trojan

Malware Config

Targets

- Target
  
  4e20b8bf1a926e7d5b84e75c920457d9dc572ec78b9a23d1b08afcefe9b78e5c.bin
- Size
  
  4.4MB
- MD5
  
  34d77868cbf62fda6b88a5c7b037d3f3
- SHA1
  
  00cdfeaa48544e5c6f0ba3d9329bb015e51e5972
- SHA256
  
  4e20b8bf1a926e7d5b84e75c920457d9dc572ec78b9a23d1b08afcefe9b78e5c
- SHA512
  
  c4e6e76c670d94062cedac1abfa814e2062087cc12626581c66754b642c17f5d296a5e37b546a9549f30a9a96e59daea8e2b7f86786f999b75124791f4bbcd8b
- SSDEEP
  
  98304:LCVeYx5HKqvpDRG1DMlRiQQxX/sqS1zHOrBNI:LqXHNvwp5sjzau
Score

10^/10

hydra banker collection credential_access discovery evasion infostealer persistence trojan
- Hydra
  Android banker and info stealer.
  banker trojan infostealer hydra
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

behavioral2

hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

behavioral3

hydrabankercollectioncredential_accessdiscoveryevasioninfostealertrojan