hydra | 676252be67035bf42b740041865d8a902988eb32111bcf9995e5ae774c420930

General

Target

676252be67035bf42b740041865d8a902988eb32111bcf9995e5ae774c420930.apk
Size

4.7MB
MD5

9fc0aa2fac6d9f36c2bc26cfec8278ce
SHA1

f768666ee5f2c8a197bbc95a0b8a674d919c7c08
SHA256

676252be67035bf42b740041865d8a902988eb32111bcf9995e5ae774c420930
SHA512

6ade9d6c32caaa03449e973b9f7e934c07b1ca84e48469cf379abfa81dcf0699b4fcf3e2f85022cd5324d256682edb0d17a768bc8f05562836a8d57588b50c15
SSDEEP

98304:DEJefbQL79Az8VCvGvPEhnzKIrzj5LFnGmu3FOT:D1f4hLVCPzKIrzJu1c

Score

10^/10

hydra banker collection credential_access defense_evasion discovery evasion infostealer trojan

Malware Config

Extracted

Family

hydra

C2

https://gist.githubusercontent.com/olimpiamilano200/65c0969b6dc440233852de072ac97545/raw/helloworld.json

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra
Hydra family
hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-2.dat	family_hydra1

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/oppose.assist.baby/app_DynamicOptDex/bTi.json	4489	oppose.assist.baby
/data/user/0/oppose.assist.baby/app_DynamicOptDex/bTi.json	4489	oppose.assist.baby

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	oppose.assist.baby
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	oppose.assist.baby

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	ip-api.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	oppose.assist.baby

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	oppose.assist.baby

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

oppose.assist.baby
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
PID:4489

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/oppose.assist.baby/app_DynamicOptDex/bTi.json

Filesize
3.1MB

MD5
ec683eb71d77ec19a2b7f62a896976a5

SHA1
c3f8908ebcd923895266ef85c28957a0203f9482

SHA256
b044b9c285319817afebd4ced88c901d7ab5c02c5e8307a6d5141c45b553a5c3

SHA512
9598028da31de7a4577048dd736a1297ceb1328af038049903e6ecc7d83249f0b50b805ee9c034949631e905f590e379e478916c2fc3824f1bab29e0b57abb13

Download Submit
/data/user/0/oppose.assist.baby/app_DynamicOptDex/bTi.json

Filesize
3.1MB

MD5
9380d17837e17c235ec232c7def111ab

SHA1
0d10ff65ce0bccad51baa16613356d1f6206d510

SHA256
e06240fa53e1632d6576fac32a3d60ae099593bba6b985fbbdd5cd305ac56a66

SHA512
ddf5e0c4217a2b9c9f8c5e8670facc4e9622f7da063f73d8a23402d937fd72a60ac3b3d2f51bfb17ca0dd49937cdb5f57065a297956369936a0e5d4155bf3420

Download Submit
/data/user/0/oppose.assist.baby/app_DynamicOptDex/oat/bTi.json.cur.prof

Filesize
1KB

MD5
286f98ddc8a02b932b774950a2f063af

SHA1
d6a0b194c8031d45addf0170b0cf628882e244ce

SHA256
43c8937739cbd980640bd9aa8d25328c21c9a571b16155a17ca47181df3b2f2b

SHA512
8c26e84a2ebe09fbdc488b8c889ffe0472af26aa0f9d006a8d217678c568bb137ef1a13a849128848d7824102e8001be3f5e8a6c154d815afaaed7e30142bbe3

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads