Extracted

• • Target

    574897127da229e7a7162b39bd20ba4becb89fc6fdfcf303a20deb1f456aead6

  • Size

    3.3MB

  • MD5

    a121f64c01e31eaf2c4f896c9d596182

  • SHA1

    2ac7b5d2882caef3a27b263e54d2acc2c888cae6

  • SHA256

    574897127da229e7a7162b39bd20ba4becb89fc6fdfcf303a20deb1f456aead6

  • SHA512

    2dd00b4b454f10b00729c45f3d1d3b7024f58b6ada7d89236a62ca620e4e874b2c6cd71027ffb5a9a0b1f88d5b20403108fd97537a4e38a4102d396628ff9ac9

  • SSDEEP

    98304:GYNqFXbZBArOViBsKgPErzLUV9nS3AA6YyWPTYghI8i/:Gy0DAKViBePE3qnmkYKghI8I

  Score

  10^/10

  hydrabankerinfostealertrojanevasionstealth

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Makes use of the framework's Accessibility service.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3