Extracted

• • Target
    b19f9076fe10bde5fd77ffb80a4f32aa2fb6b2e86591429464b804940568f858
  • Size 4.9MB
  • SHA256 b19f9076fe10bde5fd77ffb80a4f32aa2fb6b2e86591429464b804940568f858
  • MD5 07b9a38d74ba6f7185da778062dd77fb
  • SHA1 c0dc36a7e8c414e51761b0229e01a67217a3444f
  • SHA512 ffa635b6836db833f5829ef31398a58c14385ad59f943cee2f032b42b93ad87c30563bc5aad3766d614a0db63d62901afa25a4a60b67d2054373ec475dd352e6
  • SSDEEP 98304:MnbfFGIK6jdojpaUpX+hqCtGwIl27tS/N1V/eetfKmUkliEPFwbsVXoO:MnDFFl216qCgwiX/NzeBmUmiswbux
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  hydrabankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencetrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra family

    hydra

  • Hydra payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Reads the contacts stored on the device.

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2