Overview

overview

10

Static

static

6

8147c1b4ca...6d.apk

android-9-x86

10

8147c1b4ca...6d.apk

android-10-x64

10

8147c1b4ca...6d.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    27/03/2025, 22:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8147c1b4ca19e7bd0dd9f7866fbda3495f378bd94b903a5db9a8f52bc1aea76d.apk

  • Size

    4.5MB

  • MD5

    df1060078eb031d5e66f7f3a4bdc9cb9

  • SHA1

    f748299bf1067c6784dda59842720c2e217bc249

  • SHA256

    8147c1b4ca19e7bd0dd9f7866fbda3495f378bd94b903a5db9a8f52bc1aea76d

  • SHA512

    c7c687304fb294f17db0c3a3670d3a0935ed04cb5cd1e485a20d78afc81574055531106caf3d483ba3208de7b959ffd7e833242fc1c035fbe21d6bafed42206c

  • SSDEEP

    98304:+8zDmmytRTWqA/e42JFbbGfNqsE5bCKLyNndn2BLr8wdX:+8zDmpDTWh23JZbGfO+oyld2RrRX

Score
10/10
hydrabankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

hydra

C2

http://wahwedbontonz30facezconiboesd12312sergag.com

DES_key

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Hydra family
    hydra
  • Hydra payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery

Processes

  • com.grprjaftg.qotgmafug
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Reads the contacts stored on the device.
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    PID:4804

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.grprjaftg.qotgmafug/app_dex/classes.dex
    Filesize

    2.7MB

    MD5

    45ea2b8f52a6fbc82f6970fae1830efa

    SHA1

    3cb9ac4cf0acee1765b5fb4e961efdca147b4ecc

    SHA256

    317dd1a2f2e4610a2f3e7c5e9f597043f11ed1fe49249910a21fef83ab7511d4

    SHA512

    868de8d63a17796cc4a8f13a15ed5339f0d918575306090bd23c2a4c9de583e0f9e5970d21a2dc44c3ef71c815621d09d9c25cbde97c5aa8e2c11d0b9aa1bbb3

    Download Submit

  • /data/user/0/com.grprjaftg.qotgmafug/cache/classes.dex
    Filesize

    1.3MB

    MD5

    25c4c93944bda0df211ff7623d420aae

    SHA1

    93bb9aea4fc9262fa9fa09e71dd2c252d2587c8d

    SHA256

    10f7df597456f0d40122c6d9a3254163921501decfbae640bb0941f4c3fd3b2b

    SHA512

    70eacf7295e962e3f2065e35778ad0db7fc1f69f35c8676ddde4e08fa3f125dd56ad0175b829ae5b42d1d8185660b6cb88add1de26d5a878c25bc116d4e9be34

    Download Submit

  • /data/user/0/com.grprjaftg.qotgmafug/cache/classes.zip
    Filesize

    1.3MB

    MD5

    5dc3b08bd2aadff0a662dfbd86ef1159

    SHA1

    66fe1aad96a0c23db9f6b8e58ae563e2ea67947e

    SHA256

    8be9accd815dfbbd13067a9980596b612f46ab274b625c3096d2c8fd1b4222aa

    SHA512

    9c2d57bc47a4dba385434cd4a375c3cfe8150553cabf16f73832625f8e9859874b2b3ce9cb03be0be797bc1b6a7d4daee1fc03d2361c1f5cd36e91cb6e5c478d

    Download Submit