Extracted

• • Target
    fb.apk
  • Size 4.3MB
  • SHA256 fb61404d33ac0737ff718c80082abdbf5bd9883ac5683c9f50dd71728d1805e3
  • MD5 d8ddb04654662e3a32249fda25162b86
  • SHA1 f9c79ae7e90def7dbacb286c477e5726f43665a8
  • SHA512 6f78261c9d1ca0ef0c34bc065f5cd53bd83322e2124e17eb49e7f2f3e4a228e61561dd1d8ec64e90c1191fc9a8b3d7b6851dd3fbc47b28c0612ba0ee5ae7b9f5
  • SSDEEP 98304:aBPF1cvREzGXhfRU4QXC7F+xenl/n9aEoXme5Ixpfbz4npn:MPFWuzqTQS78xenlvoEoXmnxpfbg
  • TLSH
    T17126128AE786A957ECF2C33983B5C16A4D164C504B47E3535D09727D28BBED08E81F8E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionhydrainfostealertrojan

  • Family: Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra

  • Hydra payload

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Reads the contacts stored on the device.

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1