Extracted

• • Target

    13e082e408ee870c35487ba8b2589a44a14e4048bab5b647af0e0f03075ae80a.bin

  • Size

    2.1MB

  • MD5

    0351b970d847aa86f2b2bc1fb8400cef

  • SHA1

    76d6c57c873099e6c62ad78c61df40e11a8fc26e

  • SHA256

    13e082e408ee870c35487ba8b2589a44a14e4048bab5b647af0e0f03075ae80a

  • SHA512

    99595a7704651723243cc8f2e4161b8d6c4446b57481349284c57b9d5fbc4257764e62d5ab44ac13e556085cf39634ed20f19321741c2f8fa1bb05d36e87383b

  • SSDEEP

    49152:ol2EVGP1f6qZhw2rgrpCjQavyOgA28eiEKhJqBAtCQa:C2GGd6qZh73v728eiE7BA4j

  Score

  10^/10

  hydrabankerinfostealertrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads information about phone network operator.

  behavioral1behavioral2behavioral3