Analysis
- max time kernel
147s - max time network
152s - platform
android-13_x64 - resource
android-33-x64-arm64-20260325-en - resource tags
- submitted
30/03/2026, 03:51
General
- Target 56520eabdbd97a436868305176e2d1ba.apk
- Size 3.0MB
- Sample260330-eeta6ses7z
- SHA256 1c2695d5314b46ab77ff6ea879318161310d792f4e5339926bb0aa5dd5421bf6
Score
10/10
Malware Config
Signatures
- Hydra
Android banker and info stealer.
- Hydra family
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
Processes
-
com.drddfwrl.ajwqenv1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
base.apk.classes1.zip
tmp-base.apk.classes6282887662806690208.zip