Hydra
Having its roots as a “dropper services” as described in our BianLian blog, Hydra went a long way from using outdated overlay attack techniques, to a fully capable banking malware. Although still having such capability, starting from February 2019, Hydra is no longer used as dropper but as a functional and stand-alone banking Trojan.
It features screencast capabilities (like the Anubis Trojan), enabling actors to visualize what is happening on the device in real-time, but also a back-connect proxy option, enabling actors to impersonate the infected device and use it to perform fraud. Some other features include remote app installation, remote screen locking and the possibility to use Google firebase as command handler.
The following screenshots show some of the overlays used against banks operating in Turkey:
Hydra is operated privately and until recently was targeting exclusively banks operating in Turkey and some crypto wallet applications. Beginning 2020, the actors expanded the list of targets to include applications from major banks all around the world (see the appendix for targets). Taking into consideration the ongoing evolution of the Trojan, the expansion of the target list could either mean that the actors decided to grow their fraud opportunity or that they are planning to enter the malware rental market.
Expanding the target list to more countries and more institutions will also pose new challenges for this Trojan; it means trying to remain undetected by a large spectrum of malware and fraud detection solutions.
The next important step for Hydra to be successful internationally will be to add a RAT functionality to its payload. Due to the well-thought-of modular architecture of the bot, actors will certainly be able deal with such enhancements pretty easily; one more reason to keep an eye on it!
Samples
SHA-256 |
|---|
dac4480cf9725a73f53e0c0e9229f249cde4ccbc11b299fcff830d682eee4d93 |
53410fb1861dc954a9c6d27908c50e754e9774eb4404ff408cf5ac7f8996737c |
59ac851979b00a4c927068a36154cd85ecca89d9dd8db18ab77268c772d082fc |
Target list
Package name | Application name |
|---|---|
com.akbank.android.apps.akbank_direkt | Akbank Direkt |
com.albarakaapp | Albaraka Mobile Banking |
com.binance.dev | Binance Exchange |
com.btcturk | BtcTurk Bitcoin Borsası |
com.denizbank.mobildeniz | MobilDeniz |
com.finansbank.mobile.cepsube | QNB Finansbank Cep ªubesi |
com.garanti.cepsubesi | Garanti BBVA Mobile |
com.ingbanktr.ingmobil | ING Mobil |
com.kuveytturk.mobil | Kuveyt Türk |
com.magiclick.odeabank | Odeabank |
com.mobillium.papara | Papara |
com.pozitron.iscep | ݺCep |
com.teb | CEPTETEB |
com.thanksmister.bitcoin.localtrader | Local Trader for LocalBitcoins |
com.tmobtech.halkbank | Halkbank Mobil |
com.vakifbank.mobile | VakıfBank Mobil Bankacılık |
com.ykb.android | Yapı Kredi Mobile |
com.ziraat.ziraatmobil | Ziraat Mobile |
finansbank.enpara | Enpara.com Cep ªubesi |
tr.com.hsbc.hsbcturkey | HSBC Turkey |
tr.com.sekerbilisim.mbank | ªEKER MOBİL ªUBE |
at.bawag.mbanking | BAWAG P.S.K. |
at.easybank.mbanking | easybank |
at.spardat.netbanking | ErsteBank/Sparkasse netbanking |
at.spardat.quickcheck | QuickCheck |
at.volksbank.volksbankmobile | Volksbank Banking |
au.com.bankwest.mobile | Bankwest |
au.com.cua.mb | CUA |
au.com.ingdirect.android | ING Australia Banking |
au.com.nab.mobile | NAB Mobile Banking |
au.com.suncorp.SuncorpBank | Suncorp Bank |
com.akbank.android.apps.akbank_direkt | Akbank Direkt |
com.albarakaapp | Albaraka Mobile Banking |
com.amazon.mShop.android.shopping | Amazon Shopping |
com.anz.android.gomoney | ANZ Australia |
com.axabanque.fr | AXA Banque France |
com.bankaustria.android.olb | Bank Austria MobileBanking |
com.bankofamerica.eventsplanner | Bank of America Events |
com.bankofqueensland.boq | BOQ Mobile |
com.bendigobank.mobile | Bendigo Bank |
com.binance.dev | Binance - Cryptocurrency Exchange |
com.bitcoin.mwallet | Bitcoin Wallet |
com.bitfinex.mobileapp | Bitfinex |
com.bitmarket.trader | Aplikacja Bitmarket |
com.boursorama.android.clients | Boursorama Banque |
com.btcturk | BtcTurk Bitcoin Borsası |
com.caisseepargne.android.mobilebanking | Banque |
com.chase.sig.android | Chase Mobile |
com.citibank.mobile.au | Citibank Australia |
com.coinbase.android | Coinbase - Buy Bitcoin & more. Secure Wallet. |
com.coinomi.wallet | Coinomi Wallet :: Bitcoin Ethereum Altcoins Tokens |
com.commbank.netbank | CommBank |
com.connectivityapps.hotmail | Connect for Hotmail |
com.db.businessline.cardapp | Meine Karte |
com.db.mm.norisbank | norisbank App |
com.db.pwcc.dbmobile | Deutsche Bank Mobile |
com.ebay.mobile | Fashion & Tech Deals - Shop, Sell & Save with eBay |
com.finansbank.mobile.cepsube | QNB Finansbank Cep ªubesi |
com.fullsix.android.labanquepostale.accountaccess | La Banque Postale |
com.garanti.cepsubesi | Garanti Mobile Banking |
com.greenaddress.greenbits_android_wallet | Green: Bitcoin Wallet |
com.grppl.android.shell.CMBlloydsTSB73 | Lloyds Bank Mobile Banking |
com.grppl.android.shell.halifax | Halifax: the banking app that gives you extra |
com.htsu.hsbcpersonalbanking | HSBC Mobile Banking |
com.imb.banking2 | IMB.Banking |
com.imo.android.imoim | imo free video calls and chat |
com.ingbanktr.ingmobil | ING Mobil |
com.isis_papyrus.raiffeisen_pay_eyewdg | Raiffeisen ELBA |
com.jiffyondemand.user | Jiffy |
com.kuveytturk.mobil | Mobil ªube |
com.latuabancaperandroid | Intesa Sanpaolo Mobile |
com.liberty.jaxx | Jaxx Liberty: Blockchain Wallet |
com.lynxspa.bancopopolare | YouApp |
com.magiclick.odeabank | Odeabank |
com.mail.mobile.android.mail | mail.com mail |
com.mobillium.papara | Papara Cüzdan |
com.moneybookers.skrillpayments | Skrill |
com.moneybookers.skrillpayments.neteller | NETELLER |
com.mycelium.wallet | Mycelium Bitcoin Wallet |
com.navyfederal.android | Navy Federal Credit Union |
com.netflix.mediaclient | Netflix |
com.palatine.android.mobilebanking.prod | ePalatine Particuliers |
com.paypal.android.p2pmobile | PayPal Cash App: Send and Request Money Fast |
com.plunien.poloniex | Poloniex |
com.Plus500 | Plus500: CFD Online Trading on Forex and Stocks |
com.pozitron.iscep | ݺCep |
com.rbs.banklinemobile.natwest | NatWest Bankline Mobile |
com.rbs.mobile.android.rbs | Royal Bank of Scotland Mobile Banking |
com.schwab.mobile | Schwab Mobile |
com.snapchat.android | Snapchat |
com.starfinanz.smob.android.sfinanzstatus | Sparkasse Ihre mobile Filiale |
com.suntrust.mobilebanking | SunTrust Mobile App |
com.targo_prod.bad | TARGOBANK Mobile Banking |
com.teb | CEPTETEB |
com.thanksmister.bitcoin.localtrader | Local Trader for LocalBitcoins |
com.tmob.denizbank | MobilDeniz |
com.tmobtech.halkbank | Halkbank Mobil |
com.unicredit | Mobile Banking UniCredit |
com.unocoin.unocoinwallet | Unocoin Wallet |
com.usaa.mobile.android.usaa | USAA Mobile |
com.vakifbank.mobile | VakıfBank Mobil Bankacılık |
com.wf.wellsfargomobile | Wells Fargo Mobile |
com.yahoo.mobile.client.android.mail | Yahoo Mail – Stay Organized |
com.yinzcam.facilities.verizon | Capital One Arena Mobile |
com.ykb.android | Yapı Kredi Mobile |
com.ziraat.ziraatmobil | Ziraat Mobil |
de.comdirect.android | comdirect mobile App |
de.commerzbanking.mobil | Commerzbank Banking App |
de.consorsfinanz.onlinebanking | Consors Finanz Mobile Banking |
de.dkb.portalapp | DKB-Banking |
de.fiducia.smartphone.android.banking.vr | VR-Banking |
de.ingdiba.bankingapp | ING-DiBa Banking to go |
de.postbank.finanzassistent | Postbank Finanzassistent |
eu.unicreditgroup.hvbapptan | HVB Mobile B@nking |
finansbank.enpara | Enpara.com Cep ªubesi |
fr.banquepopulaire.cyberplus | Banque Populaire |
fr.creditagricole.androidapp | Ma Banque |
fr.lcl.android.customerarea | Mes Comptes - LCL |
it.bnl.apps.banking | BNL |
it.bnl.apps.enterprise.bnlpay | BNL PAY |
it.bpc.proconl.mbplus | MB+ |
it.copergmps.rt.pf.android.sp.bmps | Banca MPS |
it.gruppocariparma.nowbanking | Nowbanking |
it.ingdirect.app | ING DIRECT Italia |
it.nogood.container | UBI Banca |
it.popso.SCRIGNOapp | SCRIGNOapp |
mobi.societegenerale.mobile.lappli | L'Appli Société Générale |
mobile.santander.de | Santander Mobile Banking |
net.bnpparibas.mescomptes | Mes Comptes BNP Paribas |
org.banksa.bank | BankSA Mobile Banking |
org.bom.bank | Bank of Melbourne Mobile Banking |
org.electrum.electrum | Electrum Bitcoin Wallet |
org.stgeorge.bank | St.George Mobile Banking |
org.westpac.bank | Westpac Mobile Banking |
piuk.blockchain.android | Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum |
posteitaliane.posteapp.apppostepay | Postepay |
tr.com.hsbc.hsbcturkey | HSBC Turkey |
uk.co.santander.santanderUK | Santander Mobile Banking |
uk.co.tsb.newmobilebank | TSB Mobile Banking |