hydra | fd6475ed03f1ce5b743382016b7c8125c876c46fc4d0343516621434e4873b4a

Analysis

max time kernel
147s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
27/03/2025, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cbdd422daf93e15b2135f0f6feebf7428eaaaba4aeaf18c12e882e67a849c89.apk
Size

2.6MB
MD5

723d4d2c92d5d6da8fe7c30e21a3fe01
SHA1

a898aaf26cbccc88c372c59414be88d5e3e7991a
SHA256

9cbdd422daf93e15b2135f0f6feebf7428eaaaba4aeaf18c12e882e67a849c89
SHA512

96b26e1462ba1cc02505c14ee1f54798b1f176c0a95a0564294980315038f5d2eaa02f0c558edd24fefb18dc52f20412044cecab9926b2ccba989bfc3284c895
SSDEEP

49152:bxNEjeXAouzDMDACtf0gx9wfZBobdydftLkvBy/54VgVFzIz+OQ:bxFpuzDJCtf0gx9wRdx6W+VeB6u

Score

10^/10

hydra banker collection credential_access defense_evasion discovery evasion infostealer trojan

Malware Config

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra
Hydra family
hydra

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nvlcdjjl.yrsbiav/code_cache/secondary-dexes/base.apk.classes1.zip	4798	com.nvlcdjjl.yrsbiav

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.nvlcdjjl.yrsbiav
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nvlcdjjl.yrsbiav

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	ip-api.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nvlcdjjl.yrsbiav

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nvlcdjjl.yrsbiav

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.nvlcdjjl.yrsbiav
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
PID:4798

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.nvlcdjjl.yrsbiav/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
902KB

MD5
3da0adb9a845fa82f3225e07aa272895

SHA1
c17f93be72857afef107e6b7e890df963c5dfa76

SHA256
47712b429fa3c12ee432042830dce272a98885c8aeb5dfad6b25eaeab8d2d0fc

SHA512
c47dfa2e18b08d19542411f6a15a3a0972b0446a08fc2109cc2ed69fe7bbbbf78b5b88793fbfd5ee718c7d6f77ee41b318baff82c13fa45b99c66eb1dfe6f472

Download Submit
/data/user/0/com.nvlcdjjl.yrsbiav/code_cache/secondary-dexes/tmp-base.apk.classes6254112623003627966.zip

Filesize
378KB

MD5
7ae3b51e69fec54f7acba4f70258f3f9

SHA1
5debeaa3c39c58c1b1f235661bd1db9bac411811

SHA256
977f6816b12424c491a9ae113872dd5509f89cd6e37750c75c13290ca8a1d98a

SHA512
ae66b1457dae9813cbe82ad64fb883c36799b6e5dd1bd3b3f1efd02feb562d88eb370df88168969e00b33ae9cdfd02c3bab0080d707844322c54187ccecdbfe4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads