Overview

overview

10

Static

static

6

5487ee6a11...81.apk

android-9-x86

10

5487ee6a11...81.apk

android-10-x64

10

5487ee6a11...81.apk

android-11-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    27/01/2025, 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5487ee6a115d22ebb62ca821c1db8cc12d9275060cd730a7fdaea0655196a981.apk

  • Size

    2.6MB

  • MD5

    b153a2b2637a2344be8aed6e15cc5860

  • SHA1

    4557c7ef5561fc397b0cc7144d640e60d00b49c4

  • SHA256

    5487ee6a115d22ebb62ca821c1db8cc12d9275060cd730a7fdaea0655196a981

  • SHA512

    cd415034ec193a0b0ccd633c15fa05740e655efeaa2cc48b4bcd2a55d42a211ae6f051d226311a299b3c236191da9e03357cc28948a5d6334882905c3b40abc4

  • SSDEEP

    49152:L5llCCdTUD1SzzfewA+aaf0y5F1voCE8EIK8kq1c0NTg8RbsbHfREj1m3:1JkkzfewrR0y5F1gCdBK89c0Nk85sTRX

Score
10/10
hydrabankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

hydra

C2

http://fhuiooedjefjheeffemensb.info

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra family
    hydra
  • Hydra payload 4 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence

Processes

  • com.elegant.sun
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Reads the contacts stored on the device.
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4340
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.elegant.sun/app_DynamicOptDex/IIrjgo.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.elegant.sun/app_DynamicOptDex/oat/x86/IIrjgo.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4365

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.elegant.sun/app_DynamicOptDex/IIrjgo.json
    Filesize

    973KB

    MD5

    cd2c9ab4a4f8990a544e968baf7e2f78

    SHA1

    1d84fd4aaff60452d80e00020bba561a305be352

    SHA256

    8d62796c2adf0aa398004a24dc9ea3ec09b7dc31146d39fadaaa9da932d6082a

    SHA512

    da612f7a975bf2a45b443544193fa0fa3ec954766f6aea47bcc294d8bdacc7f04434bb9abee152ad0dcf9233f6d38c7e02e096b65ada7dc4815fd167a89fd64f

    Download Submit

  • /data/data/com.elegant.sun/app_DynamicOptDex/IIrjgo.json
    Filesize

    973KB

    MD5

    7379b152c196ac52d19c6524c3c9977d

    SHA1

    3b2410490349af6bf913abc1d8ea52dc8540364d

    SHA256

    b7905edd6e3abe8603470bd80d513948b52b3ad47e660429ec9bbaf6a5ed0403

    SHA512

    03c17a5205a7b7c86062c74474f89e758f9f9d2937c6bdf96da250cd88e0fd8686c92d08632efe77311eda81d1da5df9d5c8807a92c8faaf53319cf66d6d7c2f

    Download Submit

  • /data/data/com.elegant.sun/app_DynamicOptDex/oat/IIrjgo.json.cur.prof
    Filesize

    1KB

    MD5

    596e2231a0b1901a42d9b7c922d25205

    SHA1

    402384ab53aa75f701b1096d5d78a68e00ef194e

    SHA256

    17df3c8096a1f8d4f15457dd5276ad2d05ad7090422015f798da8854bdfccaa4

    SHA512

    6bc10a453233ad7fcce332983653ef8befc9c0990d8a5f661718b1ad6de88552e040ec074f33d92c6734ce4d1a75abfc7abdf6c5624787b3b658f6c0b82b76fc

    Download Submit

  • /data/user/0/com.elegant.sun/app_DynamicOptDex/IIrjgo.json
    Filesize

    2.2MB

    MD5

    c49a28bceb2fef999fdda4c65e304e62

    SHA1

    e24f7710812d302ae746cfa53f811406821ee417

    SHA256

    ba6d1ca73f6c3df74d2bd32ebe8311de1c7c211b5dd36b017a8fcf2d2ceed3cc

    SHA512

    1a315ff449c8f3fadd52168bed1e59f37616cf05e8670e7f9fe3640584ad7c1f96faf18c2064185958a8f472e41b7c193d9e3f19c1fd4b52907336995275340c

    Download Submit

  • /data/user/0/com.elegant.sun/app_DynamicOptDex/IIrjgo.json
    Filesize

    2.2MB

    MD5

    79eb4f3b5cb1f3904e1194bbf01dbf35

    SHA1

    7fbaa74fd34ddd46b7dc8720202fdb6a528dfa3d

    SHA256

    48c87efccfa989b06ff911cdb633479399f0bbfb0eea4e2c7e94f0a1785b5a89

    SHA512

    8a829594119eecc5990fafdd1733d1b86c62726b9830049d453813b642d5480163886a5437d71c860afa4a4cfd8f10d7c5c61e6856b4222366f1106bd32fcc69

    Download Submit