Extracted

• • Target

    152c236f84d44d34c3d0c6a6450ed933893fb6ea274e5561157f8a92966c0448

  • Size

    3.2MB

  • MD5

    b5efac544d0252fa6e455623973d7785

  • SHA1

    a3be74cf193eabf31eb342a4c47349ff5d2ed98b

  • SHA256

    152c236f84d44d34c3d0c6a6450ed933893fb6ea274e5561157f8a92966c0448

  • SHA512

    d9da522ba1179750ed5168ba652f37d88a542b3241802e8817a8f9aee60e67c1d408dacace1e9c2eddeb4a0de9872b2ea20c4947817e884d1fd6dd14c50edd14

  • SSDEEP

    49152:dLkoqMI6jH8bN35czKUjMMC59xtoXJX5kdW2AL+pHqRzgmhRh5wSWh/DrYItwTG1:dL7qKjH8U+UjMd5y+7A0HN1h3nw+vTMs

  Score

  10^/10

  hydrabankerinfostealertrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Makes use of the framework's Accessibility service.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

  behavioral1behavioral2behavioral3