Extracted

• • Target
    8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430.apk
  • Size 2.8MB
  • SHA256 8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430
  • MD5 d1a68785559ae6b0049a2bd1798277a1
  • SHA1 8ea0706e77e57810ff1bc9073f3701772f032557
  • SHA512 b4c676c19dedf7b582598bc8bc9d3bf260b3847564d7da755cf9e694abdf2ad3555da526b7ff847dcbddf75b9d1183924a29078d181b313fcec18c8b5349637a
  • SSDEEP 49152:Ucz4N3omNn0M+CGN3SPXLD8S/obeUQGkfC1T3Eb0KizuNAGq6BXk2M:LrmR0vCSC/robeZGkfk0xA1XX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  hydrabankerinfostealertrojanevasionstealth

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Makes use of the framework's Accessibility service.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3