Extracted

• • Target

    com_xhwoylhty_xwqllcong.apk

  • Size

    4.4MB

  • MD5

    c9b50e181e4119ba28fe02d2a1660175

  • SHA1

    522f2f3cc5ecc29f6c66ac7d8b41a3d944742254

  • SHA256

    d2fd5348e03bbc69b9de411da7551c3bc0cc0de5f75725452d66a4cd2654137e

  • SHA512

    56ee0acb58f6efef95a60bc59936982e9b41ff760b2c889de8e66a69d1de582386e7ea77e38a4e1967329ae76ca7bb681fe756c3a92980e0a9499c7db6e0809f

  • SSDEEP

    98304:v1PMtzqdDby6Jn2oOSHSI2Rd0IudwbcJgH7TWqNyyB13R3xGisVgYroy:NUhoJH5OCIuObcC/3yI3xRsVgwoy

  Score

  10^/10

  hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencestealthtrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra family

    hydra

  • Hydra payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Reads the contacts stored on the device.

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests accessing notifications (often used to intercept notifications before users become aware).

    collectioncredential_access

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Requests modifying system settings.

    evasion
  behavioral1behavioral2behavioral3