hydra | adca984304f23557bbab99360a86e331ac018d15c9fbdbcb286c9f7ecf2f53df

Analysis

max time kernel
147s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
23-10-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

716003c3056c3d8483a1fb469596b7d9_JaffaCakes118.apk
Size

3.1MB
MD5

716003c3056c3d8483a1fb469596b7d9
SHA1

cee5c812eaec44015c844718e211a162ce497f49
SHA256

adca984304f23557bbab99360a86e331ac018d15c9fbdbcb286c9f7ecf2f53df
SHA512

98b2b8149f0e5b45980e9439e1f1e01ec568048aad1bc08680be178b768b945ec230508dec4ff5d58e551c1a1958b3cd4ee6c044e4d3df8e17170be879d67954
SSDEEP

49152:xKq+vZPoStSYCPXc8Z4jpnauk82apEUhOVZEHcafxYx0MG0fd/D51:xgoStoMBjpnHR2apEBZWc8xYxLhX

Score

10^/10

hydra banker collection credential_access discovery evasion infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.wbyjkbij.oljtmmc/code_cache/secondary-dexes/base.apk.classes1.zip	4835	com.wbyjkbij.oljtmmc

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.wbyjkbij.oljtmmc
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.wbyjkbij.oljtmmc

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wbyjkbij.oljtmmc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wbyjkbij.oljtmmc

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.wbyjkbij.oljtmmc
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
PID:4835

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.wbyjkbij.oljtmmc/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
902KB

MD5
beb0a98b5a2345bf887ccc632e2d1500

SHA1
17254a6415f07fe3e4c8787d07ac00be4280a9d1

SHA256
46031e5f833dbeaa0667ff37b663eb117c4135ce7b554823fe5ba4cf850eddc6

SHA512
f742f16d5354682932833568bf0702178b7b2f69fc2ca7899c56d7df89bb228fc8db53eafc6e4e71519b755c4337e1a0e1ad83f2d45834a7972841f3479a77ff

Download Submit
/data/user/0/com.wbyjkbij.oljtmmc/code_cache/secondary-dexes/tmp-base.apk.classes7501121622219506865.zip

Filesize
378KB

MD5
d2a30e8ba5f1d322dd61e3144603dec3

SHA1
1b700898474e7c0d2844dc4f68989bb042eb70f4

SHA256
fb9ae5eec454a26e1b2026a3a328e9610a8f1f76723ea10e25e2c166f4b5893e

SHA512
241e6d970218013c26148981b4e3264afe79033a6d860c548ba7e0b84b76e10881b6e30f5dad97172f72c3b830044ce34d08a0ec772c240c26ef7928de1abf56

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads