Extracted

• • Target

    5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f.apk

  • Size

    2.5MB

  • MD5

    9dce53cc6e6b6dac4fb6809c91dfc65a

  • SHA1

    cc0b6bb5f40418f8c8acfd76c2c257a386820a27

  • SHA256

    5fecfd0b8d79d736b7e4f6e691f6592fc79b204a1d8e1b53a429ffe0ec06393f

  • SHA512

    9ad44686ecb65fb205b9854b5870474b3dbb544b5e186bc092c2b0e9bb603f473ba24d59eca07c9da95bf335524e3a5320ef9ef2949729dfd0a7b6889e4979e8

  • SSDEEP

    49152:yczkN3OFFeI5f+bByP3p0vTx6PrSeojWfTp7e4GgBgl1thgg2wSiID3Kv8g8Cdu3:VtFFeWfmB0ZI6TD7p7Gggf2wnID388oI

  Score

  10^/10

  hydrabankerinfostealertrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Makes use of the framework's Accessibility service.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

  behavioral1behavioral2behavioral3