Extracted

• • Target

    CoinbaseUpdate20.14.apk

  • Size

    2.8MB

  • MD5

    4a221804f5dec022c97fb357a9cfaef3

  • SHA1

    d7ed8ef2bcfdd0a4d9dd80a55180cf24240a3121

  • SHA256

    eb2f45849072ef2f4d638ce47b4f5a7b277c4569896f756a1bdc69d519530f79

  • SHA512

    8669b638ace30100ab920940d2773248f2d557be993bfc75be21e473835f1027924c103ab36847d2d66337008534f18c539cdb3a32ab36324852300b3120480e

  • SSDEEP

    49152:gczMN3P6UMvE2d8J+qE2WsSYuy3raEasn5KXyG7TLoGDtcX7LprG9:3Y6U8E2dgXE2mYuy3Hasn8XyGHLooars

  Score

  10^/10

  hydrabankerinfostealertrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Makes use of the framework's Accessibility service.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

  behavioral1behavioral2behavioral3