Overview

overview

10

Static

static

6

0cbd9e4773...e7.apk

android-9-x86

10

0cbd9e4773...e7.apk

android-10-x64

10

0cbd9e4773...e7.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    16/02/2025, 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7.apk

  • Size

    4.7MB

  • MD5

    19d608e6ae206d1201a73e260ae291c1

  • SHA1

    c7de4d18c2c03d0167465af4dc52e4c42f782a65

  • SHA256

    0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7

  • SHA512

    9b9f63bb7d231ccb29a42b87cff4a4564749ce42b3265085e391d9a50991dc8bdfcf3af0480a6a2f2591590517a82ce556c1227d633f755d23270a8ab006cd91

  • SSDEEP

    98304:6yGnvxA5rpV5it+P6dvQ/wto1SUKxRlv0A5mjv34dZGEeA8c5Q:5GnJA3Si6dI/wysDLFmj/qBeAbQ

Score
10/10
hydrabankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

hydra

C2

http://12123-123dcvmolded1235asd123sd-123dvas-we12c-21.org

DES_key

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra family
    hydra
  • Hydra payload 4 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence

Processes

  • com.dknwqqcns.ondnaxnqp
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Reads the contacts stored on the device.
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4258
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4284

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

2
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Protected User Data

1
T1636

Contact List

1
T1636.003

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.dknwqqcns.ondnaxnqp/app_apk/payload.apk
    Filesize

    974KB

    MD5

    3baeaa766ea7f31a9147208efd957c75

    SHA1

    c701de3d0e55425394ccbf8e0967639e86f3c54e

    SHA256

    75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

    SHA512

    9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

    Download Submit

  • /data/data/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex
    Filesize

    2.2MB

    MD5

    afd83eaec6e5419f402cfb114af48f41

    SHA1

    0d92bb9ec82c43694319430178a45b9d2b8f2bf1

    SHA256

    d127dbcd7ffd3c452be748eebef5ac45cf21029f96241a0c06d0f38c2ba5757c

    SHA512

    94d5753321403495c4812e8549823b6cd3606f56436e80f123cb83aa01fff37570a498a4085c1f0f65a14fc5ab30344e467ffde2e69275bcf7daef9270f361f2

    Download Submit

  • /data/data/com.dknwqqcns.ondnaxnqp/cache/classes.dex
    Filesize

    972KB

    MD5

    b60f12fb5f37e39b4b60408d21bbf54b

    SHA1

    da0c4b1994553deed56e83eac6d947623269b522

    SHA256

    0d6dc394d3fdb2b58b6c7d7ededdfd6a87d389ac0827f15b5d27205d347b2317

    SHA512

    636b2bbae304a93d2731e47508e2c387ae29bc3df072c8571bf02d3b690ad912987323cfe56d98e3e977d0cb22046a0a9a6bd26f589dd0ef6b61516b976fdfe2

    Download Submit

  • /data/data/com.dknwqqcns.ondnaxnqp/cache/classes.zip
    Filesize

    973KB

    MD5

    d3bc67e550c88553ddefe5dc26c4dad7

    SHA1

    03c936af0cab89a749db60bd94bde4d35c269edd

    SHA256

    314e495c3ec6522387b88e60055c1d1981a8865e2c2b87c3b55c2786b2efe355

    SHA512

    6b3781deea4923cdd46db5844620be50c89c18de9ec1d9e0f53e0cd498a512c8d3cc9441d1ba46ee7c3b4fe28ff1809c83581aba03273a6186112939c9a063d1

    Download Submit

  • /data/data/com.dknwqqcns.ondnaxnqp/cache/x41bisfTMKrsQCxvJgn9Dm64yPIElwD8H8NZGzsu.zip
    Filesize

    19.5MB

    MD5

    944e7b90ad43792e107c4d3b4fd2af71

    SHA1

    92e6639e96590d7f4deb46fc53019ae3056cf7ee

    SHA256

    35b008e53e966d355f9448930a6c3a11aa97da7cc893679632dd543ad27facd7

    SHA512

    1478ea2a93866a1e715ed242f0765ae0e6766e9ea2425520a6e1b7e0edecfe8557188b9b01d2b5a6d05d6a43d6539ab58a78a13ec2812cf315358c4fa9b5c0f5

    Download Submit

  • /data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex
    Filesize

    2.2MB

    MD5

    1f73c3cf4633376ae1f4da3805e6d23b

    SHA1

    51e08b05f0e916784668c59ef7c4bb0d321e2c0c

    SHA256

    0acb528981ed36950e40d97cce591f31d6cf9e5632ec97db9fef5c82a366a4ab

    SHA512

    c08139f44083fd73aaeedd89645c7dae182038a03ad2da62c66c6a74db529451ae7c2acfa0445405135b2470acf08344f2ed167789062856a67e4cd672ba5530

    Download Submit