Analysis
- custom tags
- max time kernel
142s - max time network
153s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
- submitted
19/08/2026, 00:41
General
- Target f84e5ccc0c78f97e27d486f22c28f7f3c8f48f7455f51ce4c89940297057fd26.apk
- Size 7.1MB
- Sample260819-a1trlsvzcs
- SHA256 f84e5ccc0c78f97e27d486f22c28f7f3c8f48f7455f51ce4c89940297057fd26
Malware Config
Signatures
- Family: Hydra
Android banker and info stealer.
- Hydra payload 1 IoCs
- Android banker: accessibility service abuse with overlay injection 1 IoCs
DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.
- Android dropper: runtime DEX/class loading of a staged payload 1 IoCs
Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.
- Contact harvesting with SMS self-propagation 1 IoCs
Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
- Notification listener abuse for OTP and message theft 1 IoCs
Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
- Silent screen capture via MediaProjection 1 IoCs
Acquires a MediaProjection session and pipes the virtual display into an image reader or encoder, enabling continuous capture of everything shown on screen including credentials and one-time codes. Combined with accessibility auto-approval this runs without further user interaction.
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes
-
com.msvmjhta.mekecjf1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
base.apk.aUyG7kf1.k8y
tmp-base.apk.aUyG7kf4133470915672894110.k8y