Extracted

• • Target
    11611468349b2ed5cba038f61230914169505a1e5cffe879f0a858e365a6b94e.bin
  • Size 1.4MB
  • SHA256 11611468349b2ed5cba038f61230914169505a1e5cffe879f0a858e365a6b94e
  • MD5 58a49e137e242f0d74dc7e98fea135d0
  • SHA1 9db9c116d46aeeb6a58f32c8ebc967a6c5c00a9a
  • SHA512 eb3bbb8acd71e909a1cf0ca87510005020422b900ef088f70555b154ef878e974955b36b696d9ae3ae5f5f8f2919f12d0a103abdbae9411c438c41c3556ef46a
  • SSDEEP 24576:RgVnWlm6bRNnZJaER47HTRPZ+YTnyN+/iL0z4csK3mPuISugmZHKXsdxT:RgVn78RtZJdRmdP0g6L0zzmP5SlmZrdJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Reads the contacts stored on the device.

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2behavioral3