hydra | 5ea08f9e12343305a57235de51c85ca4cce3685c25ba65bf45b2cde4479935db

Analysis

max time kernel
2s
max time network
74s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
06-11-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ea08f9e12343305a57235de51c85ca4cce3685c25ba65bf45b2cde4479935db.bin [MConverter.eu].apk
Size

1.5MB
MD5

c6da6f6ef69f5f7c003223fccc04a8a4
SHA1

cd12adc399700178c70817d0882217ce564704a5
SHA256

5ea08f9e12343305a57235de51c85ca4cce3685c25ba65bf45b2cde4479935db
SHA512

4087e64bd5c285fcb4e6b4c9b2cbd3d43f189d5eb40380bc9faca34f7add9389d38d046aac8298d7ba081cebbad72d4356618016f8aea2d0071d45d427315c9c
SSDEEP

49152:B0vRcaOzydZF3w6tVcU4wNRojs1w8hzwS4bEj+:Y+aT13wANN/w8h+Ej+

Score

10^/10

hydra banker evasion impact infostealer trojan

Malware Config

Extracted

Family

hydra

AES_key

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra
Hydra family
hydra

Hydra payload 2 IoCs

Processes:

resource	yara_rule
/storage/emulated/0/Android/obb/com.grand.kilogram/dp/a.a (deleted)	family_hydra1
/storage/emulated/0/Android/obb/com.grand.kilogram/dp/a.a (deleted)	family_hydra2

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.grand.kilogram

ioc	pid	process
/storage/emulated/0/Android/obb/com.grand.kilogram/dp/classes.dex	4627	com.grand.kilogram
/storage/emulated/0/Android/obb/com.grand.kilogram/dp/classes.dex	4627	com.grand.kilogram
/storage/emulated/0/Android/obb/com.grand.kilogram/dp/a.a	4627	com.grand.kilogram
/storage/emulated/0/Android/obb/com.grand.kilogram/dp/a.a	4627	com.grand.kilogram

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.grand.kilogram

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.grand.kilogram

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.grand.kilogram

com.grand.kilogram
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4627

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.grand.kilogram/files/libdexload_arm64.so

Filesize
246KB

MD5
2c619d28882a9786a57cc97be26c6017

SHA1
02b5e72cb710632bb9d664e6d8d9235bd487518e

SHA256
aea070f4ed86631cca4c5326d57eec9aa9b7238d752e0580a468c26e4b6ef93c

SHA512
4fec1620547fbd908e4c9b8ec3e450bf64416b8bceb86cae6ee2cc4fdc46e125c577d7416643c8d7357eb1b19f2968aed6fba99c9addd03192138e16dfb01ab6

Download Submit
/storage/emulated/0/Android/obb/com.grand.kilogram/dp/a.a (deleted)

Filesize
2.2MB

MD5
757cfcc42f918f15c61fbf5b9d0948b2

SHA1
31e378e26685bd32fa540e89cd3d5e882bb3762a

SHA256
e885832e111d96f02bdca681ab18008ab0f8d2998ec8b894d3c0d06630734266

SHA512
c1e81634081cdd190759a71e7a64552b9aa88dc6b2e73b783f5d7bfbdd86f68369ca416ae57200ee7ff25b827d4329cbbfb14db6132221cff2ecd36717656a68

Download Submit
/storage/emulated/0/Android/obb/com.grand.kilogram/dp/classes.dex (deleted)

Filesize
68KB

MD5
3323f89bdf5700b293cfe810f919c335

SHA1
6c2e385e543886aef248c37d2be39b0838616159

SHA256
cd52dd4e30c541f6563d6942193f636e70712ee5482c8ba51369ded646a0683f

SHA512
6b6a91baaa5ec3379d403a80751e6237bd3fd1e37d41bff98c3c0c1b1299d58f138806eef723b45f05bdf4a0a2235934aceade119e90b7d4fa2fde3a6fc5bfaa

Download Submit
/storage/emulated/0/Android/obb/com.grand.kilogram/dp/classes2.dex (deleted)

Filesize
1005KB

MD5
1a7730a012c9821a1d585501bc61cd21

SHA1
c12f190d89e266d41906e267fbb4390fb8bca1d1

SHA256
7e895efd40a13c5f6750abd152246123cb115454c9ca5c7f5794f21824dd41d4

SHA512
c9d579a7627f1fca83b925d40f78a9a7224319c104078d6efeedd7633c1758d3b6ef9b0c362fb092db92dd58f846d69cb0c22f13ada8ee974847b24bcf7e0f82

Download Submit
/storage/emulated/0/Android/obb/com.grand.kilogram/dp/monay (deleted)

Filesize
963KB

MD5
bfb0cb35748ae2fc0c251d22c928b0a9

SHA1
9f9caceb399e379629f17d9cbfa3c71f81079484

SHA256
5ae972ae1e6694984d5200ab2da840c82f4190641ae4c07670a30e9987e89842

SHA512
80cf02b7d61a1cc9eea583dc1d910e79c5ada11a49967ac688be7f5d13c4e4fed176efb715f88ede18666cfce8bb3bb48ed091f0046fd352cb71009270ee7818

Download Submit