Extracted

• • Target
    7366130a6409e8c5eaae207a242f5b439863003ab00d8ce5c8982765dfb06be7
  • Size 5.0MB
  • SHA256 7366130a6409e8c5eaae207a242f5b439863003ab00d8ce5c8982765dfb06be7
  • MD5 d040dbedc7f81bcd3904832f3d1ec3cf
  • SHA1 ec8a54d29285089679a3c0c5d9f6508e4b05abc4
  • SHA512 415aec7a54e6da40e4e80e48cb486df9af708831f4b3ccbd74341842bec98a7450437e5b2ff961ba4c0dd6143619e6b1b6dee4f60ed2f59974eb926d433c9156
  • SSDEEP 98304:iYvHIXpdbr5FQofxyqlnB6EvOYVoyW5E8nONIaObIJBWE4RrItUlV8zSwqN+p:tKJQofxyoBBmYVoyW5E9eCJIEkskAS2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  hydrabankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencetrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra family

    hydra

  • Hydra payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Reads the contacts stored on the device.

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2