Extracted

• • Target
    Play_Store.apk
  • Size 6.2MB
  • SHA256 810926f89430144fd258ed4a95f1d77215f657a4e7dac2ce0c410bcffbdca99e
  • MD5 fe30b3542e7220a71945d7cc18bfe820
  • SHA1 77c0e6b91ea6488bd88aad145363f57115f69e4a
  • SHA512 0ec44e9ac76cd6cbdd98f1961b552e1d22b293d3343c6045c6a167ec06d99bbf99b3bb293971b302c5e821093c74fe420306604c4a96e9b8aa0b9e9b99c4bf55
  • SSDEEP 196608:c48ZHR5wquT2+2QnK5iyZ1D6o+KpJuDBTJiX5c2:b8RRyqQnKJZQTEJAt0G2
  • TLSH
    T1A6562387E385A827E8F6C33D927A42A789069C268B03D743199173BD4CB76CC4E55F9C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionhydrainfostealerpersistencetrojan

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra family

    hydra

  • Hydra payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Reads the contacts stored on the device.

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2behavioral3