Extracted

• • Target
    763cac1b4e4ca9e9858233e4685e020d6e0df87deaea99d3a044a7a4fb9f9e3f.bin
  • Size 1.5MB
  • SHA256 763cac1b4e4ca9e9858233e4685e020d6e0df87deaea99d3a044a7a4fb9f9e3f
  • MD5 b1d9294e68ce5771a5a3fe1fe61f5f57
  • SHA1 da651c12cef1fdb7ed8604122512201a1307945a
  • SHA512 6d7701d2920be90a1c5b67c139ad00ee0a3585f7b0b67d720532d6c0c490b6b518e03d32256a5deaeb1ea8abfbe225b6e6471c65aa616f9559c16a43cc6cb466
  • SSDEEP 24576:kg94rvrkD8EUji761PRfCCiZIWdrWh1fdXZmz4cOm6pwvHubcz51Z37OjWXnL:kg94zO89ji76lJCPZIsWaM57iecz/ZrX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionhydrainfostealerpersistencetrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra family

    hydra

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Reads the contacts stored on the device.

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2behavioral3