Analysis
- custom tags
- max time kernel
143s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
- submitted
17/08/2026, 01:05
General
- Target 6180ced96b5f13d0fa66fc76e9a390fd134462da158cef5073e5204bcacaba6f.apk
- Size 5.2MB
- Sample260817-bfp4cs1apf
- SHA256 6180ced96b5f13d0fa66fc76e9a390fd134462da158cef5073e5204bcacaba6f
Malware Config
Signatures
- Family: Hydra
Android banker and info stealer.
- Hydra payload 1 IoCs
- Android banker: accessibility service abuse with overlay injection 1 IoCs
DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.
- Android dropper: runtime DEX/class loading of a staged payload 1 IoCs
Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.
- Contact harvesting with SMS self-propagation 1 IoCs
Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
- Notification listener abuse for OTP and message theft 1 IoCs
Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
- Silent screen capture via MediaProjection 1 IoCs
Acquires a MediaProjection session and pipes the virtual display into an image reader or encoder, enabling continuous capture of everything shown on screen including credentials and one-time codes. Combined with accessibility auto-approval this runs without further user interaction.
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.nekrqiep.jjzyrud1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
tmp-base.apk.fUf8TFy7178096433949675419.Gfj
base.apk.fUf8TFy1.Gfj