Extracted

• • Target
    VIRUSS.apk
  • Size 3.9MB
  • SHA256 806d430ab6c6d78d26061a2d837e8236a45994acd43d6e623495391dd8bc0df8
  • MD5 390fd73da69bf2ab9c6482e1021b5fcc
  • SHA1 97d64248009a2c7ff2b14329177af40b99365096
  • SHA512 34fb32899bf78512c4d05538963eed2b2a6a742211bf0a3ff2c8faf946f543499de8e14b457fe00953ebde69d73f286ee2a44c7f0187f7ef89cc53e006347e97
  • SSDEEP 98304:9xQVlf5YcCWEjgQxJNEKVPl+1SPuCHienhIg15bd6gNxEMHszD0X9:DQVxG9RBV93rCafkIsz+9
  • TLSH
    T189163320F295A702D5FE133D84F7A9C2453ABD81AFA2834F2490335E35B39D45BE59B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionhydrainfostealerpersistencetrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra family

    hydra

  • Hydra payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Reads the contacts stored on the device.

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests accessing notifications (often used to intercept notifications before users become aware).

    collectioncredential_access

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Requests enabling of the accessibility settings.

  • Requests modifying system settings.

    defense_evasion
  behavioral1