Extracted

• • Target

    7483f5cc6b0e5630f18dba01f5a810d0

  • Size

    2.1MB

  • MD5

    7483f5cc6b0e5630f18dba01f5a810d0

  • SHA1

    b86ff064886ebe04463bcdda11e0e3e3fce6eab6

  • SHA256

    0b7938b3d1c0163085aac6ab5434230e5a6473ef50fb550ce0fdaee35361fe89

  • SHA512

    7d1003dc9877f4926338f197927140824da3d866fb28924f646a5ab0538e69014c29981c7c51e2a9ae4c5cd61e5d9f162a20c2b7bdbb3967f837ab8fd0f7e682

  • SSDEEP

    49152:utTmFjrcfkEqAoXLWQXvblPYHLKojWX2GlXysS4cKdL:GT4cMEmXL3l8jyX1XS4c+

  Score

  10^/10

  hydrabankerinfostealertrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Makes use of the framework's Accessibility service.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

  behavioral1behavioral2behavioral3