Extracted

• • Target

    56b42b7ce829306afb00ddca01bed06ed486f77f9b9337724a43e79247c4eb81

  • Size

    3.1MB

  • MD5

    aba560b5c5c356f5b9075c7c31024672

  • SHA1

    bc5db278ac3446e78e6afeab50f2566572fca076

  • SHA256

    56b42b7ce829306afb00ddca01bed06ed486f77f9b9337724a43e79247c4eb81

  • SHA512

    96d46381eccf6d6551a8227507a3c5a7ddf06be02d346f9a6570909a0c3cdd85978c8233d666e8568d52578b9aad7a031fbaad6be8505bc237d13f9f6d76a9c3

  • SSDEEP

    98304:Y2fKuZOxKQcJLtQt7jXW1RMhQJ2gyWZX2R:RfKvXZFjXKSi2BWZmR

  Score

  10^/10

  hydrabankerinfostealertrojanevasion

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Makes use of the framework's Accessibility service.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3