hydra | 60d897552b97f3674000a6251cf3eea86cf37ff40a0d3a647a84e1bb1228eb36 | Triage

Sharing

General

Target

60d897552b97f3674000a6251cf3eea86cf37ff40a0d3a647a84e1bb1228eb36.bin
Size

4.5MB
Sample

240804-1z69essamf
MD5

97f14823391ad297d0dfefd6dea3a594
SHA1

3d5295923a7dad2ce656192e96085ad230d24992
SHA256

60d897552b97f3674000a6251cf3eea86cf37ff40a0d3a647a84e1bb1228eb36
SHA512

122b13fe6e1ecdc8c674013435bfd3874be151fb651a4009e5d8e8e30e673075518eeb62ec521a2a6fa108a25109616b02fbc6735c086f567b7dfb00405f791d
SSDEEP

98304:qpmvfdSo6MFilhnZMN20pJMaPVVyf8NIhnVYE6NMRL3Ne+LmUKNa:qpufeMFWZMN2Jaef8NMVeMRL9HmUK4

Score

10^/10

hydra android banker collection credential_access discovery evasion infostealer persistence trojan

Malware Config

Targets

- Target
  
  60d897552b97f3674000a6251cf3eea86cf37ff40a0d3a647a84e1bb1228eb36.bin
- Size
  
  4.5MB
- MD5
  
  97f14823391ad297d0dfefd6dea3a594
- SHA1
  
  3d5295923a7dad2ce656192e96085ad230d24992
- SHA256
  
  60d897552b97f3674000a6251cf3eea86cf37ff40a0d3a647a84e1bb1228eb36
- SHA512
  
  122b13fe6e1ecdc8c674013435bfd3874be151fb651a4009e5d8e8e30e673075518eeb62ec521a2a6fa108a25109616b02fbc6735c086f567b7dfb00405f791d
- SSDEEP
  
  98304:qpmvfdSo6MFilhnZMN20pJMaPVVyf8NIhnVYE6NMRL3Ne+LmUKNa:qpufeMFWZMN2Jaef8NMVeMRL9HmUK4
Score

10^/10

hydra banker collection credential_access discovery evasion infostealer persistence trojan
- Hydra
  Android banker and info stealer.
  banker trojan infostealer hydra
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Credential Access

Input Capture

GUI Input Capture

Keylogging

Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

Tasks

static1

behavioral1

hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

behavioral2

hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

behavioral3

hydrabankercollectioncredential_accessdiscoveryevasioninfostealertrojan