Overview

overview

10

Static

static

6

0cbd9e4773...e7.apk

android-9-x86

10

0cbd9e4773...e7.apk

android-10-x64

10

0cbd9e4773...e7.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    16/02/2025, 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7.apk

  • Size

    4.7MB

  • MD5

    19d608e6ae206d1201a73e260ae291c1

  • SHA1

    c7de4d18c2c03d0167465af4dc52e4c42f782a65

  • SHA256

    0cbd9e4773a7a703886c402b220c311d2919402c4f50960a6af969ff4da4f4e7

  • SHA512

    9b9f63bb7d231ccb29a42b87cff4a4564749ce42b3265085e391d9a50991dc8bdfcf3af0480a6a2f2591590517a82ce556c1227d633f755d23270a8ab006cd91

  • SSDEEP

    98304:6yGnvxA5rpV5it+P6dvQ/wto1SUKxRlv0A5mjv34dZGEeA8c5Q:5GnJA3Si6dI/wysDLFmj/qBeAbQ

Score
10/10
hydrabankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

hydra

C2

http://12123-123dcvmolded1235asd123sd-123dvas-we12c-21.org

DES_key

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra family
    hydra
  • Hydra payload 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests uninstalling the application. 1 TTPs 1 IoCs
    defense_evasion

Processes

  • com.dknwqqcns.ondnaxnqp
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Reads the contacts stored on the device.
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests uninstalling the application.
    PID:4627

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Indicator Removal on Host

1
T1630

Uninstall Malicious Application

1
T1630.001

Input Injection

1
T1516

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

2
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Protected User Data

1
T1636

Contact List

1
T1636.003

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.dknwqqcns.ondnaxnqp/app_apk/payload.apk
    Filesize

    974KB

    MD5

    3baeaa766ea7f31a9147208efd957c75

    SHA1

    c701de3d0e55425394ccbf8e0967639e86f3c54e

    SHA256

    75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

    SHA512

    9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

    Download Submit

  • /data/user/0/com.dknwqqcns.ondnaxnqp/app_dex/classes.dex
    Filesize

    2.2MB

    MD5

    afd83eaec6e5419f402cfb114af48f41

    SHA1

    0d92bb9ec82c43694319430178a45b9d2b8f2bf1

    SHA256

    d127dbcd7ffd3c452be748eebef5ac45cf21029f96241a0c06d0f38c2ba5757c

    SHA512

    94d5753321403495c4812e8549823b6cd3606f56436e80f123cb83aa01fff37570a498a4085c1f0f65a14fc5ab30344e467ffde2e69275bcf7daef9270f361f2

    Download Submit

  • /data/user/0/com.dknwqqcns.ondnaxnqp/cache/classes.dex
    Filesize

    972KB

    MD5

    b60f12fb5f37e39b4b60408d21bbf54b

    SHA1

    da0c4b1994553deed56e83eac6d947623269b522

    SHA256

    0d6dc394d3fdb2b58b6c7d7ededdfd6a87d389ac0827f15b5d27205d347b2317

    SHA512

    636b2bbae304a93d2731e47508e2c387ae29bc3df072c8571bf02d3b690ad912987323cfe56d98e3e977d0cb22046a0a9a6bd26f589dd0ef6b61516b976fdfe2

    Download Submit

  • /data/user/0/com.dknwqqcns.ondnaxnqp/cache/classes.zip
    Filesize

    973KB

    MD5

    d3bc67e550c88553ddefe5dc26c4dad7

    SHA1

    03c936af0cab89a749db60bd94bde4d35c269edd

    SHA256

    314e495c3ec6522387b88e60055c1d1981a8865e2c2b87c3b55c2786b2efe355

    SHA512

    6b3781deea4923cdd46db5844620be50c89c18de9ec1d9e0f53e0cd498a512c8d3cc9441d1ba46ee7c3b4fe28ff1809c83581aba03273a6186112939c9a063d1

    Download Submit

  • /data/user/0/com.dknwqqcns.ondnaxnqp/cache/x41bisfTMKrsQCxvJgn9Dm64yPIElwD8H8NZGzsu.zip
    Filesize

    316KB

    MD5

    8b22e5e2f4046f6d34e6436ffb6fdb52

    SHA1

    902c91eec0e61402018d282d71d7f4def1bca84a

    SHA256

    041159c10f6ed125bfc893e22db5cc39b16f000f88970950685d9160fb0363d7

    SHA512

    a90b2e4f5a3ca0adc2c1ed1ad1e08f6051bbd4981bd6c3bd727951dd022a7c3fa1efee229b3912c2f303468eca318f047bc54bfc8b9391058fa54d0077981b31

    Download Submit

  • /data/user/0/com.dknwqqcns.ondnaxnqp/cache/x41bisfTMKrsQCxvJgn9Dm64yPIElwD8H8NZGzsu.zip
    Filesize

    17.5MB

    MD5

    6333969eb2b6a7dea12b08a6b6d40920

    SHA1

    d799729164133a86712c4fbd6e340190ce1cf2e5

    SHA256

    78056258ca992ca4711583597fe97a9f7f950c8dfc47355052ca4c25acd18782

    SHA512

    6d1647dc33ab2d75160729ad7d71f5392e0dcc6eb89880afc9573bdd5249e114adfaf89cbfb8614fad3b0a8c35133607b0f64609337ccc7b42daaf1abbf6fc41

    Download Submit