hydra | f6da0d9f1d74f2f80cd4d69183a78ccc1b3679689419262c9704787cea754726

General

Target
f6da0d9f1d74f2f80cd4d69183a78ccc1b3679689419262c9704787cea754726.apk
Size 7.3MB
Sample260819-arax5stdqa
SHA256 f6da0d9f1d74f2f80cd4d69183a78ccc1b3679689419262c9704787cea754726
MD5 2eb95b88fab546af95d509c94a26a930
SHA1 cc0d10a420a0ec0ea3f96d89318af0ad325423d8
SHA512 4deabfb458934244fe84508df035430b6c8550834141d11818d73e5ff3de1123cd64bcce79cd5dee93d9d356ee05a1b474944a809cb1c4c5a2bf16bda55e97ee
SSDEEP 196608:83YEQjk9z5MpNelJKDWx0RiQdyjynFAL9cR3n:8nQwd5GNejeWabyj40En
TLSH
T1997633D499E283A2FE1965329E96B982772016754CC3E03B9E001EE445DBC4F1F27E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion discovery dropper evasion exfiltration hydra infostealer loader overlay persistence rat sms spyware suricata trojan

Malware Config

Signatures

Family: Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Android banker: accessibility service abuse with overlay injection 2 IoCs

DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.

banker trojan overlay

resource	yara_rule
behavioral1/memory/4349-0.dex	ANDROID_Overlay_Banker_AccessibilityAbuse
behavioral1/memory/4286-0.dex	ANDROID_Overlay_Banker_AccessibilityAbuse

Android dropper: runtime DEX/class loading of a staged payload 2 IoCs

Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.

dropper loader

resource	yara_rule
behavioral1/memory/4349-0.dex	ANDROID_Dropper_RuntimeDexLoad
behavioral1/memory/4286-0.dex	ANDROID_Dropper_RuntimeDexLoad

Contact harvesting with SMS self-propagation 2 IoCs

Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.

sms trojan exfiltration

resource	yara_rule
behavioral1/memory/4349-0.dex	ANDROID_Contacts_SMS_Propagation
behavioral1/memory/4286-0.dex	ANDROID_Contacts_SMS_Propagation

Silent screen capture via MediaProjection 2 IoCs

Acquires a MediaProjection session and pipes the virtual display into an image reader or encoder, enabling continuous capture of everything shown on screen including credentials and one-time codes. Combined with accessibility auto-approval this runs without further user interaction.

spyware rat exfiltration

resource	yara_rule
behavioral1/memory/4349-0.dex	ANDROID_MediaProjection_ScreenCapture
behavioral1/memory/4286-0.dex	ANDROID_MediaProjection_ScreenCapture

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.emmtyggz.qvvtshu/mzwqsyyibh/blaygywgwgiwygg/base.apk.rrehzhe1.hbz	4349	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.emmtyggz.qvvtshu/mzwqsyyibh/blaygywgwgiwygg/base.apk.rrehzhe1.hbz --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.emmtyggz.qvvtshu/mzwqsyyibh/blaygywgwgiwygg/oat/x86/base.apk.rrehzhe1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.emmtyggz.qvvtshu/mzwqsyyibh/blaygywgwgiwygg/base.apk.rrehzhe1.hbz	4286	com.emmtyggz.qvvtshu

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.emmtyggz.qvvtshu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.emmtyggz.qvvtshu

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
Network activity triggered a Suricata alert
suricata

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
11	ip-api.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.emmtyggz.qvvtshu

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.emmtyggz.qvvtshu

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.emmtyggz.qvvtshu

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	/system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/com.emmtyggz.qvvtshu/app_torfiles/tor /data/user/0/com.emmtyggz.qvvtshu/app_torfiles/tor -f /data/user/0/com.emmtyggz.qvvtshu/app_torfiles/torrc __OwningControllerProcess 4286

com.emmtyggz.qvvtshu
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4286
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.emmtyggz.qvvtshu/mzwqsyyibh/blaygywgwgiwygg/base.apk.rrehzhe1.hbz --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.emmtyggz.qvvtshu/mzwqsyyibh/blaygywgwgiwygg/oat/x86/base.apk.rrehzhe1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4349
- /system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/com.emmtyggz.qvvtshu/app_torfiles/tor /data/user/0/com.emmtyggz.qvvtshu/app_torfiles/tor -f /data/user/0/com.emmtyggz.qvvtshu/app_torfiles/torrc __OwningControllerProcess 4286
  2⤵
  - Checks memory information
  PID:4395

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

geoip

Path /data/data/com.emmtyggz.qvvtshu/app_torfiles/geoip
Size 3.7MB
SHA256 9f65eab86508224b41cbf319314c070f33fdecb250d17247da83ab7b4d436159
MD5 da86c56d98ea812ce6ab42691e4d1197
SHA1 e3c910f3b2a6c916c7be33a943091ef57048b72c
SHA512 62095ef018a1e2664b380056141e54f224458727229b309f101b0961616a0e5feeaf8428b9b788df4a1408304a46f6d38bcaf9edda770dd6752251995ae49235
SSDEEP 49152:wbaF6c1Yd6dIBjmmcogfo7XmMxnhsA9Qbi3KAXmxK70+tmFmvVwf:Z
TLSH
T182060AA052B19CDAF2EEC657C1621C1D422FE05A222316B4F8D3F5AF991A7D0D0B1ED7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip6

Path /data/data/com.emmtyggz.qvvtshu/app_torfiles/geoip6
Size 2.1MB
SHA256 296911c0f69a26b5fd65f4552f6a141d6cdbb5979f62b8b7db28e7b97e0698f5
MD5 18625900e4f9b58af0db8b4a621058df
SHA1 e8bd5b2e6554c27f718f1222667c09680d75f799
SHA512 347006c25eeac5b5cccecd09dafe814cec569e4741c67d3a35dc47d605ef2110adbc0a4e689077c80216059a6a66454bfa525e3cb6fe5b03a781f1f3b8fac6c8
SSDEEP 24576:xpjD98/yp3hMocPRlQ0bKLPTTPuSqgVtMsdJmLjt+PSXTbHnbP7gsNgWwWNhMMyg:g
TLSH
T145A545740DBFD7C613C4F66A2125785F82AAF2D87E1A18F04A6AECB047D58474AEC713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor

Path /data/data/com.emmtyggz.qvvtshu/app_torfiles/tor
Size 6.5MB
SHA256 805e8995ae913e691ff3e4b6a5fce1c7d11860940ace43a5187a1f548ddcb24b
MD5 3ffe7e540a5be82f50eccd51dde09828
SHA1 e3d9711da7afed4bc89326d3bf80bbfcad7dc5cc
SHA512 8679cb1df0f82a830e952d0e9628967839dc7a96c178c481dac96ab01c815dec107b4f1b22aa7481aa0071bff9c541d9cb559a0a7268782e3a75874fbbaba7cc
SSDEEP 98304:qVJUnR8P6rgkX2GZNMvErMGrSFBFKkm4m9frwHp5ayuXomQAhd9P7acJXgY+oLp5:qO8P62GJXPv9PeSXgYs1dO8P62G
TLSH
T1B3661978F564473EC7D1A67AF69E42EF73234B6463D13221462892383FE9B648B3B051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

torrc

Path /data/data/com.emmtyggz.qvvtshu/app_torfiles/torrc
Size 336B
SHA256 9f041e2db8caed07fad0168841e985e89b4c71615d97f90faa7264bf44e796fb
MD5 a4ce7625bae755c32334ec7fe4cfd943
SHA1 e99af111cde5ab1187d12dcf5ac772ed50dc61a7
SHA512 b1da6843ee4bd6cd732e6a270185d49cbb311621f7150c980fb8402e45347bfd6b85c062d4b583fbfa81f236d3aaae23df9a9b09cdc63efdfe147dac07329cc7
TLSH
T1D6E09A06398CAACB9788E96C6C449520D802EDDEA654326167B43542CF25544E3DA3B9
MD5 SHA1 SHA512 TLSH

Submit Download

torrc

Path /data/data/com.emmtyggz.qvvtshu/app_torfiles/torrc
Size 99B
SHA256 c0fbdadf36a2b1ef0b4287b66d3a94312915faf5f10b0861e494ea6c40b62c2e
MD5 a5537c6e54c265bd4a318bdc057b604c
SHA1 00e834c03f908659e5beeb57a0828b22c2d09acc
SHA512 062a02b944e990ae4871b53e83fdf15322140f4c50df286488dc1c7ddad423708d4c4eeb97af7518c4bdb54547ee1188822cfacd4ca3ed7032961625a251cac9
TLSH
T12CB01221B3B81C4648DF4126B3611B0A1350A1198C5104F60403B956347400AC1E34C1
MD5 SHA1 SHA512 TLSH

Submit Download

tmp-base.apk.rrehzhe7310405791274698476.hbz

Path /data/data/com.emmtyggz.qvvtshu/mzwqsyyibh/blaygywgwgiwygg/tmp-base.apk.rrehzhe7310405791274698476.hbz
Size 538KB
SHA256 96cfe61cd0e5b12ae35f072bf523ff063ade23ff7724ced4f9f1b16a95e2ffea
MD5 fa495efe41a4a9dcc2b287e68eefa494
SHA1 8874e72bdb035210f46e02f7c81c41bde284e084
SHA512 3d1a5b2d00039591ca2fef151b5bf74d7c0c13069d8a403784cdba51bad378a26b3c76eb29b4eb7222a993258d0c1d0f71a632b4df5ba27d3371ecdaa421f47a
SSDEEP 12288:aewfh5pkC3ugZrOrSbLP+sKbfzoaCXSO/6XDZbjPF:TcDpkC3t+S/PN2kagHeZbj9
TLSH
T1A4C4234F72BD89A3B46DC9251A1F882E5FC767EB75ED38114CB9110CDE2EA388B59043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.apk.rrehzhe1.hbz

Path /data/user/0/com.emmtyggz.qvvtshu/mzwqsyyibh/blaygywgwgiwygg/base.apk.rrehzhe1.hbz
Size 1.2MB
SHA256 fb75b8dd1810ebc4e37962b77cad32c1a30ac56f2ccf8f419708d54523d6ce1e
MD5 d88f65468e2d0f071a5e989df570fb20
SHA1 80d4977dcdea40399e4c7f7b2ae6898e43df5dea
SHA512 2b59ac3f5e033bd1f16e948181501a63e62c1cafd960d3771978813865661a6731863a2863cdc6f4d570d4ac3149ee6442f3575d5a61d04c1e33ee2097a4cad8
SSDEEP 12288:Yg2BBSMllFIX/ILWrSGFC/WIRc/5n6OHNvHMJTVfJ35xl:Y3BBSMllFa/ILmSGo/WIR8nmJTvV
TLSH
T1AF55A60E9B11EE13DAA95B75CDBBC7A473A662408F43DF0733186B7D68522803A525CF
MD5 SHA1 SHA512 SSDEEP TLSH

Download

base.apk.rrehzhe1.hbz

Path /data/user/0/com.emmtyggz.qvvtshu/mzwqsyyibh/blaygywgwgiwygg/base.apk.rrehzhe1.hbz
Size 1.2MB
SHA256 d5bb6d31485cc56bbeef3ab7a9e371cecb3701ff15c30f7e9c52866fd5398c79
MD5 f643c594fb381a379937be7048adc67b
SHA1 ad9fe97bec868d9f2ae24ccd0dc0231a3b1e208c
SHA512 93482d3b7649fa147751167947e5319b6ccb821cf4b16f5d31c2b3de5193db916568f0e38061a9a1012ac757c6454067dd417063026b0f6e2c2ed9e68b391ec6
SSDEEP 12288:Yg2BBSMlkUGOZckU6CZzHl0/5yLRT14vL875Mn9Z35xl:Y3BBSMlkULZckFCNF0/5yLRCm5MnnV
TLSH
T18755C70E9B51EE11DAED5738CDBAC36073A66600CF46DF0B3358BB6E585228039925DF
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads