hydra | 0c29fd1ed255bce168695cc888b5b37170f9418b236375bba2a46238d0c06809

Analysis

max time kernel
146s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
25/03/2025, 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0de1add961f3a9bf6e2e391489fdbac244932352421055f23f34c93c82b8856.apk
Size

2.8MB
MD5

ffce59f44fe794ceb53c215d9c8bd17f
SHA1

0782156341937276c0883946f91187e2e2c34c86
SHA256

a0de1add961f3a9bf6e2e391489fdbac244932352421055f23f34c93c82b8856
SHA512

8558f92dd5a7238c87277db05dd537b8ecb26a314dbc0483478bf1cf0a251a2d4cb044ee4347d766293d273ca89a05f6d7aa9bbfe5567aace682b3a0640b71b3
SSDEEP

49152:eiX2WbGBGsuh5+nNj2iKqJCLmTonXh6GpsS5Mt1dtX8COcfQ6EzwTL8D9IqtdYew:eiXTGB6wRkqJCLdXh6PSK7rX8qfQ6uqJ

Score

10^/10

hydra banker collection credential_access defense_evasion discovery evasion infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra
Hydra family
hydra

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.njzbfugl.lzzhmzl/code_cache/secondary-dexes/base.apk.classes1.zip	4823	com.njzbfugl.lzzhmzl

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.njzbfugl.lzzhmzl
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.njzbfugl.lzzhmzl

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	ip-api.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.njzbfugl.lzzhmzl

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.njzbfugl.lzzhmzl

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.njzbfugl.lzzhmzl
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
PID:4823

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.njzbfugl.lzzhmzl/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
817KB

MD5
a1327adc60921f6b8644d55372a9f160

SHA1
f34f8da2a14e1dde904fb632343ccba8c2c5c627

SHA256
b32025c87c94ad0ff3a42f51268cf54c78fc72f4a82036477c608e6a71978a35

SHA512
022d5cc0168db596c66ec7fb7d3d32ec060c034601babfe7cb44099b002e1b98f96b344ade2a7de51facd297fb5082157309f9f005f713f32af8bdad8d53b6fe

Download Submit
/data/user/0/com.njzbfugl.lzzhmzl/code_cache/secondary-dexes/tmp-base.apk.classes8520814241959917594.zip

Filesize
343KB

MD5
d9a3145475e5a2beb2a42110177c9777

SHA1
e7c3aca1393dea0a30e38852ea2e609d5476c0a6

SHA256
a66ce7c9bc4c2546e9fcc2cf4c8b49e424943a8fa1f8e8ab08de5eaa5567d17c

SHA512
6116180d70633315ebc50ea232a69826ebe475553adcaf985a19228c1b513e3e0edf1d84135d768a9215c633e26289013c95df686d503d540e67af399b15e7d7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads