hydra | b0ac55805196efd6af8d21642c3dd81ea0900847c2544404292b4bfd1ce84fa3

Analysis

max time kernel
148s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
28-09-2024 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd66ce40e73dbfe2a1f6a718c5ca30da_JaffaCakes118.apk
Size

4.7MB
MD5

fd66ce40e73dbfe2a1f6a718c5ca30da
SHA1

696431ac145a50da1b1060639d7908c682f134c8
SHA256

b0ac55805196efd6af8d21642c3dd81ea0900847c2544404292b4bfd1ce84fa3
SHA512

371c38332a1ba8e1ea8224c1d2f47f14df4e8c9f78c981aacb7fa36496e7dbe0ea06e369f9236fa61b1588f0ef5b9784be1583872df4ef6b7c9504d338c00fe3
SSDEEP

98304:hN23CGCNT1OO6CuFJaylF8ZCCfxOk13C3cFR+ARW5yYbsae+P7Wv/2TrJ1ebpFA:hI3C/NTt6HVlCZCQxERARW5galPi2TFP

Score

10^/10

hydra banker collection credential_access discovery evasion infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Hydra payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-2.dat	family_hydra1

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/army.custom.bridge/app_DynamicOptDex/nONUI.json	4492	army.custom.bridge
/data/user/0/army.custom.bridge/app_DynamicOptDex/nONUI.json	4492	army.custom.bridge

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	army.custom.bridge
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	army.custom.bridge

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	army.custom.bridge

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	army.custom.bridge

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

army.custom.bridge
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
PID:4492

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/army.custom.bridge/app_DynamicOptDex/nONUI.json

Filesize
2.9MB

MD5
ce7a6326e03a012353382c57c7003cca

SHA1
cc387b5a1acd3d6ca37be33a334b8853321ada39

SHA256
89b2027db7f4979061ab23bba5f0255d65ab4831d40996609091cee6993bdb17

SHA512
810676b55874324fa44d1f45f06a7fcfe667ef73eecc48fc1295b3c1010b7899fa14ae049da10c549cb572eac29990c1381719fca6e9bea436492d63c480d3bb

Download Submit
/data/user/0/army.custom.bridge/app_DynamicOptDex/nONUI.json

Filesize
2.9MB

MD5
e88baf55960ac7227c804a0b02fdd5a3

SHA1
cc577285ad57737e7f1dd29638f1319876b68d3e

SHA256
12e54bd019c6d386c786cc33b8365036ab47aa2af1f9c43c40a0632cd76e38c5

SHA512
317d858abb6b531e86ae7a60fe1e69402e5d86afd8b7332168d6afd8aa4f213efc2bf7fddbc3b3efe92f0ff5029de580d53ef09fd537d95e76d9cc9f66c83779

Download Submit
/data/user/0/army.custom.bridge/app_DynamicOptDex/oat/nONUI.json.cur.prof

Filesize
1KB

MD5
777cdb699c72105d7ddb6a2714b6d357

SHA1
1a91d3435eca25ac0be879612e8b05ac23de79a3

SHA256
a964c7c30ae45bee345e45f3c18e169321b9c945ac87a538d365a0e222b43134

SHA512
8da49f944264f30868135994aa7d732609054d402c80277b7456df5999d95943cccdff4ffe563aea524ca2d827365ae3c48740a2ed370e00e3d0428d2d132521

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads