Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

5d6ab41098...ed.apk

android-9-x86

10

5d6ab41098...ed.apk

android-10-x64

10

5d6ab41098...ed.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    02/03/2025, 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5d6ab41098430b0f2079cd0bf715a7d59eacfbda9f743e25dacd6037f79ef0ed.apk

  • Size

    5.0MB

  • MD5

    355bc169ce558d9c5ddf2e192e002c8b

  • SHA1

    15ffba7b0c956c86608cc335712b1d568c7da159

  • SHA256

    5d6ab41098430b0f2079cd0bf715a7d59eacfbda9f743e25dacd6037f79ef0ed

  • SHA512

    bf4694b368908a65d8fa751584ef2cf5c854caf627baa54a37877aeaa8d61d22aa6cc7b9cb02c9df00b4e0aaf5ab50d75981d9dbd3745e1142aa6c2af4b8a3fd

  • SSDEEP

    98304:X25fdW7wo7fq3yyJd3FEy+/CQeVavSYYEDZmqLSgPQC/ijhFwo:myV7fSJxUBeV0SWZTP7sFwo

Score
10/10
hydrabankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

hydra

C2

http://45.83.20.56

DES_key

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra family
    hydra
  • Hydra payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence

Processes

  • com.expreyopf.fknecmswq
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Reads the contacts stored on the device.
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5243

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.expreyopf.fknecmswq/app_dex/classes.dex
    Filesize

    2.7MB

    MD5

    76920a0b90d047a55843c84228cd0549

    SHA1

    3ee921de8e91967f2d5f73e5c41481a31c0f00bb

    SHA256

    3177589064e8a2509b1fb33b91dd0cb9c1497370b02cca906b762584be8aec86

    SHA512

    58353fe2c4b466191bc516b00c87052bda587401d3e116b5ac6668257f3fd62c72894359f1bfdb3e16fc5727b4d668d99ac1342c88a4224fc9b682d660f0de5d

    Download Submit

  • /data/data/com.expreyopf.fknecmswq/cache/classes.dex
    Filesize

    1.3MB

    MD5

    3f7126be688b7e18031b9d0d0fc5aa7a

    SHA1

    0cf5650d6f2a586bb5fe223ff685e19aa350a697

    SHA256

    f643715932dbd49cffdca761ab81617f1f76cb000446b91719727679bbb4b1b0

    SHA512

    1b7c66d9ff5828284b0f68da5a5f975d35a088196661073421a956fdcbdd7cf011f3cfe1a35b8e1c6cf4008f11b69c0403004d27b7ddbf09806fee4c888464a9

    Download Submit

  • /data/data/com.expreyopf.fknecmswq/cache/classes.zip
    Filesize

    1.3MB

    MD5

    39094f79dad11a21ee75ff43a5d2eefb

    SHA1

    03be0f5703936c6a3b475357e6de2cbe6cc9e12e

    SHA256

    89c6572f194f438055d4151beca28682d67e1e54d30e8d10f81a012174751a63

    SHA512

    0562fe6dbd971c2520e947e8a18acb0681a2abe54b0b931985e3e2ff9b268e6c33fc9f19ac51af8a4cb284699eaadd0a7492a8539979306d9028cdf895b1dbed

    Download Submit